Comparing even field with lookup field in tstats search?

[loat01]

Hi all,

I'm quite new so pardon my bad exposition, I'll try my best to explain what i'm trying to achieve.

Can two fields, one from the event itself (ilo.uri), the other from an automatic lookup (il_host) be compared in a "like" fashion (ilo.uri = *il_host*) inside of a tstats search WHERE clause?

Here's my current search:

    | tstats
       values(ilo.level) AS "level"
       FROM datamodel="b2b.ilo"
       WHERE ilOutbound.level IN ("error", "warn") 
       ### AND ilo.uri = *il_host* ###
       BY _time, ilo.level
    | timechart  span=1h
    count(level) AS "level"
    BY ilo.level

[richgalloway]

No, a lookup file cannot be referenced within the tstats command.

[loat01]

i believe that's incorrect, this simple query works fine:

| tstats values(il_host)
FROM datamodel="b2b.ilo"