From a CSV file, how do I get incoming alerts that match with location data to be displayed in a dashboard?

[viji261992]

I have a "GRDB_site_list.csv" file with location details, I want to create a dashboard where the incoming alerts matching with the location should be displayed in that dashboard.

[harsmarvania57]

What are the field names do you have in raw data and column headers in lookup file ?

You can try something like this (In below query I am assuming that you location field in your raw data and you have column with name location in your lookup file.

index=yourindex | lookup GRDB_site_list.csv location AS location OUTPUT location AS l_loc | where isnotnull(l_loc) | fields - l_loc

[viji261992]

Error in lookup command: could not find all of the specified lookup fields in the lookup table.

[harsmarvania57]

You need to change field name in lookup command based on fields you have in your raw data and CSV file