Hello guys
So I have a table where there are Index and Role. In another table, there is Index and Description. So what I am trying to output is something like this below:-
Role | Index | Description
1 | a_2 | World says hello back.
|a_3| Hello
2 |a_4| WOW
Currently using join the index fields are being joined. But is there a way to do the joining without Join but only lookup?
|mvexpand Indexes
|fields Index2, Indexes, Role
|join type=outer Indexes [ inputlookup index_info_lu | rename Index as Indexes] << here>>
| stats list(Indexes) as Indexes,list(Description) as Description by Role
Give this a try
your base search
|mvexpand Indexes
|fields Indexes, Role
| lookup index_info_lu Index as Indexes OUTPUT Description
| stats list(Indexes) as Indexes,list(Description) as Description by Role
Give this a try
your base search
|mvexpand Indexes
|fields Indexes, Role
| lookup index_info_lu Index as Indexes OUTPUT Description
| stats list(Indexes) as Indexes,list(Description) as Description by Role
Thanks alot