How to use inputlookup with realtime search

[jedatt01]

I want to create a search that populates a map with real-time data. But I also have data in a lookup table that I want to include using the inputlookup command. I want the data from the lookup to populate before the realtime search begins so the first points that populate on the map are from the lookup table. Does anyone know how this can be accomplished?

[martin_mueller · Accepted solution]

You can use inputlookup in a real-time search as long as you set append=true. Here's an example:

  index=* OR index=_* | stats count by index | inputlookup append=true monitored_indexes.csv | fillnull | stats max(count) as count by index

Run that over a real-time window and you'll have the count of events from the search itself and the list of indexes without events filled in with count=0 by the inputlookup | fillnull | stats.

[jedatt01]

This worked for me. Thanks!