How can I use a variable from a lookup in a search?

[wgawhh5hbnht]

I have a lookup table that contains usernames and userids. I want to use this to match a username to userid & vice versa. I want to take the output from said lookup and search across multiple indexes for the username OR the userid. It would look ruffly something like this:

|inputlookup username2userid.csv 
| search username=a@a.com 
| table username userid
| search (index=a $username$) OR (index=b $userid$)

If I manually replace either variable with the actual values the search works. Is it not possible to pass a variable from a lookup into a search?

Thank you in advance! 

[isoutamo]

Hi

basically you have two options:

• use your current query (last line) with map command
• Switch the order to reverse and use sub queries to get those username and userid

It depends on your event amounts etc. which one is better.

r. Ismo

[wgawhh5hbnht]

1. Thank you for the response. I'm getting the following error when using the map command:

Unable to run query '(index=a "<REDACTED>") OR (index=b "<REDACTED>")'

I don't see anything in the search.log that is causing errror and I've tried specifying fields for both variables.

If I only search one index with one variable I get a similar error.
SEARCH:

| inputlookup "username2userid.csv" |search username=a
| table username, userid 
| map search="index=a $userid$"

ERROR:

Unable to run query 'index=hyperion "<REDACTED>"'

2. I'm unsure what you mean by "Switch the order to reverse and use sub queries to get those username and userid". May I have an example please?

[isoutamo · Accepted solution]

Please try 

| inputlookup "username2userid.csv" 
| search username=a
| table username, userid 
| map search="search index=a $userid$"

this should works 

[wgawhh5hbnht]

That was it! Thank you for your help!