I have a table in my dashboard:
my search*********
"$search_field$"
|lookup customer.csv license_hash as license_hash OUTPUT customer_id customer_name
|ip location client_ip
|table customer_id,customer_name,client_ip.......
In the dashboard I have a search field and on the table a drill down on this search field.
The problem: w
When I click on values of customer_id,client_ip, City,_Customer_name.....
I get no results....of course not because of the lookup after the search field in the search.
Wich changes I have to do to make it possible to search with this values?
to add |search "§search_field§"
after the lookup doesn't work.
You are taking an input record, then using the input field license_hash
to look that up and get customer_id
and customer_name
It looks like you then intend to use command iplocation
to look up the location info from the field client_ip
. however, at that point you don't appear to actually have a field named client_ip
. Is that in the initial event record, or is it in the lookup table, or is it nowhere?