Add fields in lookup with request without using index or sourcetype

[AlexH]

looHi everybody, 

i hope you can help me with my pb.

i want add fields in a lookup with a request that dont use index ..

We dont have result so i use the fillnull option en appendpipe to create result but they don't want add the bnew fields in a lookup..

the KV store fields are fixed and defined in transforms.conf and collections.conf.

for example :

| table key,Category,activation,target,tester,url
|fillnull
| appendpipe [ stats count
| eval Category = "HOST Blacklist"
| eval activation = "09/15/21"
| eval target = "Un test ajout"
| eval url = "http://www.test.html"
| eval tester = "*test.html*"
| eval key=Category.tester.target
| where count==0]
| fields - count
| table key,Category,activation,target,tester,url
| outputlookup t_lookup append=True override_if_empty=false key_field=key

i see my event in search interface but not in my lookup ..

have you an idea for adding field like this??

thanks for your help

[ITWhisperer · Accepted solution]

| makeresults
| eval Category = "HOST Blacklist"
| eval activation = "09/15/21"
| eval target = "Un test ajout"
| eval url = "http://www.test.html"
| eval tester = "*test.html*"
| eval key=Category.tester.target
| table key,Category,activation,target,tester,url
| outputlookup t_lookup append=True override_if_empty=false key_field=key

[AlexH]

thks a lot that good !!