Where did I go wrong with my inputlookup search?

mafruma — Wed, 13 Jan 2016 21:57:21 GMT

Hello all.

I have not been able to populate a table via a search that uses inputlookup. My table is only populating with the data from the events. Where did I go wrong?

My search:

sourcetype=integration.wmb.event SAPTransactionID 
| append  [ |inputlookup idocsDec.csv | fields + CREDAT,CRETIM,hour,minute,STATUS,TID | rename TID as SAPTransactionID]
| transaction SAPTransactionID
| table SAPTransactionID CREDAT CRETIM hour minute STATUS

The only data that gets populated in the table is the SAPTransactionID. All of the other fields that I want to pull data from the csv are empty.

Re: Where did I go wrong with my inputlookup search?

somesoni2 — Wed, 13 Jan 2016 22:32:16 GMT

The transaction command requires field _time to be present (to calculate duration) which seems to be missing from your Inputlookup data. If available, create a field _time in the subsearch with inputlookup and try again.

If you're only looking to group events based on SAPTransactionId, consider using stats command which is more efficient.

topic Re: Where did I go wrong with my inputlookup search? in Getting Data In

Where did I go wrong with my inputlookup search?

Re: Where did I go wrong with my inputlookup search?