How to create a search that will compare results from search with lookup?

[bosseres]

Hello everyone!

I have in search results table like A=1, B=1, C=3

I have lookup like

Type	A	B	C
server1	1	1	4
server2	1	1	5
server3	1	1	6

I need to make search, that will compare results from my search with lookup and if enough one value in appropriate column is equal, than column is true, if not - false.

For example, A=1, server1, server2 and server3 = 1 in column A, i need result A=true. B - same. But in column C there is no "3" so C is false. Help me please.

[richgalloway · Accepted solution]

Each column will have to be tested separately using separate lookups.

| lookup mylookup.csv A OUTPUT Type
| eval resultA = if(isnull(Type), "false", "true")
| lookup mylookup.csv B OUTPUT Type
| eval resultB = if(isnull(Type), "false", "true")
| lookup mylookup.csv C OUTPUT Type
| eval resultC = if(isnull(Type), "false", "true")

[bosseres]

thank you, it works!

is it possible to make comparison in one subsearch? i mean one comparison for all columns (because i have more columns than 3)

[richgalloway]

If you want a separate result for each column then you'll need multiple lookups.  The lookup command has an implicit AND for each input field.  It returns a single result if all of the fields match the same row in the lookup file; otherwise, it returns null.

If this case, you could use

| lookup mylookup.csv A B C OUTPUT Type

and would get a null Type field if C=3.  There would be no way to know, however, which field caused the "false" result.

[bosseres]

I did, not actual