I have a lookup table with three columns Endpoints, Rate, Window
I want to get the window value for a particular endpoint provided by me which i will use in my main query
The Query looks like this
sourcetype="blabla" http_url = "some endpoint"
minutesago= |inputlookup SomeFile.csv | search Endpoint = "Some endpoint" | return Window
I get an error running this query
Error in 'search' command: Unable to parse the search: Comparator '=' is missing a term on the right hand side.
Can anyone help?
It looks like you're trying to use a subsearch without putting the subsearch inside brackets.
sourcetype="blabla" http_url = "some endpoint"
minutesago=[|inputlookup SomeFile.csv | search Endpoint = "Some endpoint" | return $Window]
Using $Window tells the return command to return only the field value rather than a key/value pair.