I have a "GRDB_site_list.csv" file with location details, I want to create a dashboard where the incoming alerts matching with the location should be displayed in that dashboard.
What are the field names do you have in raw data and column headers in lookup file ?
You can try something like this (In below query I am assuming that you location
field in your raw data and you have column with name location
in your lookup file.
index=yourindex | lookup GRDB_site_list.csv location AS location OUTPUT location AS l_loc | where isnotnull(l_loc) | fields - l_loc
Error in lookup command: could not find all of the specified lookup fields in the lookup table.
You need to change field name in lookup
command based on fields you have in your raw data and CSV file