Hello,
I have a csv file which contains 12 columns and i want to use the values of the columns as arguments in my search.
i thought the best way to achieve it will be with macro that will read the file but im not sure how to do it.
maybe there is another way ?
i also tried this query :
[| inputlookup concurrency_rules.csv | fields Used* | transpose | rename "row 1" as eventtype | fields eventtype]
| transaction maxpause=2s maxspan=1s maxevents=5
| eval max_time=(duration + _time)
| eval min_time=(_time)
| rename kafka_uuid as uuids
| where eventcount!=5
| table eventtype ,min_time, max_time,tail_id,uuids
it is working but not dynamic as i wanted. the file supposed to have more than 1 row so the rename of row 1 is not good enough and also not all the values in row 1 are eventtypes. also i have more fields there that i want to use as arguments
thanks for the help
