After uploading a CSV file to an index, why is my current search not producing results from the uploaded CSV data?

[cogrunc]

Hello,

I have a problem about Data Input that is uploaded from my computer. I upload a CSV file and index the file into "indexFoo2". When I complete the "add data" stage, I can search and reach the CSV data in "indexFoo2". However, if I use the search below, all the CSV data is removed from "indexFoo2".

How to overcome this issue?

index="indexFoo1" | rex field=_raw "(?\S+)"|rex field=_raw "(\S(?\S+))\S+"|eval Foo2=upper(Foo2) | eval Foo2=replace(Foo2, "\.", "") |eval Foo3=Foo3x|fields Foo1,Foo3,Foo2| join type=left Foo3[search index="indexFoo2" |eval Foo3 =Foo3y|fields Foo1,Foo3,Foo2,Foo4]| eval Time=strftime(_time, "%H:%M:%S %d/%m/%y")| join type=left Foo2 [search "indexFoo3" earliest=-30d | eval Foo2=upper('Foo2x')  | stats count by Foo2|fields Foo1,Foo3,Foo2,Foo4 ]| eval Foo2=tostring(Foo2)| eval Foo2 = substr(Foo2,0,2).":".substr(Foo2,3,2).":".substr(Foo2,5,2).":".substr(Foo2,7,2).":".substr(Foo2,9,2).":".substr(Foo2,11,2)| search NOT count>0| table Foo3,Foo1,Foo4,Foo2

[woodcock]

You forgot an index= between search and "indexFoo3". Rather than fix it as-is, try this enhanced overhaul:

 index="indexFoo1" OR index="indexFoo2" OR index="indexFoo3" |eval Foo2=upper(Foo2) | eval Foo2=replace(Foo2, "\.", "") |eval Foo3=if(index="indexFoo1", Foo3x, Foo3y) |fields Foo1,Foo3,Foo2,Foo4 | stats values(*) AS * BY Foo3 | where index="indexFoo1" | eval Time=strftime(_time, "%H:%M:%S %d/%m/%y") | appendpipe [index="indexFoo3" earliest=-30d | eval Foo2=upper('Foo2x') | stats count by Foo2 | fields Foo1,Foo3,Foo2,Foo4] | stats values(*) BY Foo2 | where index="indexFoo1" OR index=indexFoo2" | eval Foo2=tostring(Foo2)| eval Foo2 = substr(Foo2,0,2).":".substr(Foo2,3,2).":".substr(Foo2,5,2).":".substr(Foo2,7,2).":".substr(Foo2,9,2).":".substr(Foo2,11,2)| search NOT count>0| table Foo3,Foo1,Foo4,Foo2

Neither of your rex commands captured anything (named) so they did nothing so I removed them.

[naidusadanala]

The lookup table can be uploaded at the context of the app level but not at the index level.
If the lookup table file name is "indexFoo2"

You can use the command |inputlookup indexFoo2 at that app level