How to extract data in lookup?

[smanojkumar]

Hi There!

    I'm having the query, In the station_check_kvstore lookup , the field check_date consists of 180 values for a single src_name, we are having many src_name 

   For instance,  when src_name = 51363 , check_date consists of 180 values,

If we are using this query, it fetched only 100 values of check_date for a single src_name, we need all values or the latest date in check_date,

Solution for both ways is welcome,

| inputlookup check_kvstore
| search src_name = 51363
| lookup station_check_kvstore src_name Email OUTPUT check_date
| table src_name Email check_date

Thanks is Advance!!

[gcusello]

Hi @smanojkumar,

let me understand:

• you have two lookups: check_kvstore and station_check_kvstore,
• it's possible to correlate these two lookups using two keys: src_name Email ,
• but the problem is thatthere are many (180) values for the check_date field, each one in a different row,

is it correct?

if this is your situation, you could try:

| inputlookup check_kvstore
| append [ | inputlookup station_check_kvstore ]
| search src_name = 51363
| stats values(check_date) AS check_date BY src_name Email

This is possible only if the station_check_kvstore lookup has less than 50,000 values.

if you want a table with a value for each row, you could use this:

| inputlookup check_kvstore
| append [ | inputlookup station_check_kvstore ]
| search src_name = 51363
| stats count BY src_name Email check_date
| fields - count

Ciao.

Giuseppe