Hello,
I am trying to search source=test.csv (including fieldA) with the attached lookup file.
I define the automatic lookup like 'URL as fieldA OUTPUTNEW DomainGroup AS Domain4fieldA'.
Then I search like 'source=test.csv (Domain4fieldA="G1" OR Domain4fieldA="G2") | eval Service=Domain4fieldA | fields fieldA,Service'
I expect the search result.
Service="G1,G2" in case of fieldA="www.google.co.jp" and
Service="G2" in case of fieldA="www.splunk.com"
But I get ..
Service="G1,G2,G3" in case of fieldA="www.google.co.jp" and
Service="G2,G4" in case of fieldA="www.splunk.com"
How can I search to get the correct result ?
Please notify.
"DomainGroup","URL"
"G1","www.google.co.jp"
"G1","www.google.com"
"G1","www.yahoo.co.jp"
"G2","www.google.co.jp"
"G2","www.amazon.co.jp"
"G2","www.rakuten.co.jp"
"G2","www.splunk.com"
"G3","www.microsoft.com"
"G3","www.google.co.jp"
"G4","www.splunk.com"
"G4","www.apple.com"
... View more