perhaps it is the wrong approach, but i try to use an inputlookup within a search and pass a value to this subsearch.
It looks like this:
index=myindex sourcetype=stype source=sourcename
|eval SourceHost =[|inputlookup transfer_nodes.csv
|search nodeId IN ($last_source_node_id$)
|stats first(name) as SourceHost
|eval DestinationHost =[|inputlookup transfer_nodes.csv
|search nodeId IN ($last_dest_node_id$)
|stats first(name) as DestinationHost
I get the following error: Error in 'eval' command: Failed to parse the provided arguments. Usage: eval dest_key = expression.
The problem is the passing of the value $last_source_node_id$ ($last_dest_node_id$)
I already tried to map the subsearch, then the passing works, but the result is not what i expected.
Finally I would like to use a macro like GetTransferNode($last_nodeId$)
Hope you have an idea how to solve it.
best regards and thank you in advance !
I posted it twice, sorry
I maybe missing something in the detail or your use case, but is there a reason you cant use a normal lookup rather than inputlookup?
Are you able to provide some sample data?