Compare 2 searches and Update Lookup Table and Rows

[onurragacc]

Hi All,

I am trying to do a search to compare 2 different sources. Firstly, I created a lookup to catch some rules hitting my search. In the background, my alert is running and appending results to this csv lookup file. Lookup file has also a field which is called Explanation.  What I am trying is doing a search that provide me to update a row if anything is changed in raw data. However, there is an important point. If there is no change in raw data for the lookup field, the field in lookup file should not change and it should keep the explanation. If not, the row should be deleted.

Thank you

[tscroggins]

Hi @onurragacc,

Using source as a literal example:

index=foo source IN (source1 source2)
| table rule1 Explanation
| outputlookup rule_lookup

the rule_lookup lookup will only contain rows from the search results, both updated and not updated. No additional logic is required.

Can you provide an example in SPL with corresponding events and lookup data?