Hi
I have a lookup which looks like this
no name student rollno
1 john yes 12
2 George no 2345
3 jin yes 111
How can i iterate through this lookup by the 'no' field and display each entry as a result . I only need one result at a time
so when i first run the search the result should be
no name student rollno
1 john yes 12
When i run the same search after a minute the result should be
no name student rollno
2 George no 2345
Please help
There are not many ways to store and retrieve state between searches. One idea is to use an auxiliary lookup file. Let's call it displayed.csv.
| inputlookup mylookup
| lookup displayed.csv no OUTPUT rollno AS displayed
| where isnull(displayed)
| sort no
| head 1
| outputlookup append=true displayed.csv
Lookup displayed.csv must be set up before hand, to the destination outputlookup will write into.