How to use a Lookup table to search against two sourcetypes with a common field that's named differently

New Member

I have two sources from Log files: “source1web”, “source2auth”, they both list IP addresses, but are named differently, source1web the field is “Server”, “and source2auth is “IP1”.

I need to check both logs against a lookup table “lookup1” the field in the lookup table is “Server”

Searching against 1 source works
index=index1 sourcetype=source1web [| inputlookup lookup1.csv | fields Server] |

index=index1 sourcetype=source2auth [| inputlookup lookup1.csv | fields Server | rename Server as IP1] |

when I have tried to combine the 2 it doesn't produce any results

Tags (1)
0 Karma

Super Champion

you're trying to combine the two searches into one and have one inputlookup?

have you tried renaming IP1 in source2auth as Server before the lookup instead of doing it in the lookup?

(index=index1 sourcetype=source1web) OR (index=index1 sourcetype=source2auth)|eval Server=coalesce(Server,IP1)|join Server [| inputlookup lookup1.csv | fields Server]

New Member

Worked perfectly thank you

0 Karma

Esteemed Legend

Make sure that you click Accept to close the question and reward the answerer with Karma points.

0 Karma