My search is sub search.
index=* [|inputlookup xyz.csv | fields A B | rename A as search| format ] | stats count by _raw A B
Yes it is possible to have lookups that use the field values from other lookups. Lookups run in sequence from their lexogrphical order. For example, the following will work:
[my_sourcetype] LOOKUP-a = lookup-a host OUTPUTNEW fielda fieldb LOOKUP-b = lookup-b fielda OUTPUTNEW fieldc
As this is still a top result for this issue, I'd like to add:
In general, it works.
But - if a lookup is larger than the
max_memtable_size in limits.conf (default: 10 MB), it will be indexed to disk. This seems to result in it being applied later - so if the lookup
a in the above example is too big, this won't work anymore.
Raising the limit will fix the issue.
Thanks a ton to @starcher for pointing this out to me!
Wow that's interesting and something I didn't know either. Thanks for sharing.
the auto lookup feature requires it to be in ram. So if over maxmemtablesize it isn't. Normal lookup command in SPL will work. just not "autolookup" in props.
So far I can not exactly confirm this. My "not in RAM" auto lookup works, but it seems to be applied AFTER the "in RAM" lookups. In my case, the latter depends on a field from the former, and therefore it fails.
index=YouShouldAlwaysSepcifyAnIndex AND sourcetype=AndSourcetypeToo AND [|inputlookup xyz.csv | table A] | lookup xyz.csv A OUTPUT B