Hello all.
I have not been able to populate a table via a search that uses inputlookup. My table is only populating with the data from the events. Where did I go wrong?
My search:
sourcetype=integration.wmb.event SAPTransactionID
| append [ |inputlookup idocsDec.csv | fields + CREDAT,CRETIM,hour,minute,STATUS,TID | rename TID as SAPTransactionID]
| transaction SAPTransactionID
| table SAPTransactionID CREDAT CRETIM hour minute STATUS
The only data that gets populated in the table is the SAPTransactionID. All of the other fields that I want to pull data from the csv are empty.
The transaction command requires field _time to be present (to calculate duration) which seems to be missing from your Inputlookup data. If available, create a field _time in the subsearch with inputlookup and try again.
If you're only looking to group events based on SAPTransactionId, consider using stats command which is more efficient.