topic Re: Multiple fields to filter against Single inputlookup file in Getting Data In

Multiple fields to filter against Single inputlookup file

gopiven — Wed, 30 Sep 2020 01:56:05 GMT

Hi Experts

Actually I am searching on one index, where Userid is with multiple fields like user,userids,useridvalue,user_id etc., on the events ( since it is from multiple source types). And I want to check this ids against one input lookup that contains all the Userid (only one column in lookup) and table it.
But it is not working for me. Since I am new to this platform could someone assist me please.

Please note: inputlookup filename name and inside column name are similar - Userid

Thanks in advance!

Re: Multiple fields to filter against Single inputlookup file

jpolvino — Tue, 27 Aug 2019 13:10:40 GMT

One way to do this would be to use a case statement to translate into a common field name that is used in your lookup. For example:

index="user_prod"
| eval Userid=case(sourcetype=="type1",user,sourcetype=="type2",userids,sourcetype=="type3",useridvalue)
| lookup Userid.csv Userid AS Userid
| table Userid

Re: Multiple fields to filter against Single inputlookup file

gopiven — Fri, 30 Aug 2019 08:21:06 GMT

Thanks jpolvino !
It works now!