Hello All,
I have a lookup file: table1.csv with two columns: index, sourcetype.
I have a custom index which has fields: orig_index, orig_sourcetype
I need to build and execute an SPL for each row of the lookup file.
Thus, need your inputs to build the same.
Thank you
Taruchit
I tried to build below SPL so far:-
|inputlookup table1.csv |table index, sourcetype
|eval key="index=custom_index orig_index=".index." orig_sourcetype=".sourcetype."
| timechart span=1d avg(event_count) AS avg_event_count
|predict avg_event_count future_timespan=1
|tail 1
| fields prediction(avg_event_count)"
With above SPL, I get three columns: index, sourcetype and key.
In column key, I get the corresponding SPL of the row. Thus, I need help to execute and generate results for each row.
Thank you