How to combine Eventtype Search and lookup data into one table?

[hgoyal]

Hi Everyone,

I have an search query and a lookup.

Search query gives some filenames and their time of creation and in my lookup which is from external team contains the same filename and transfer time of that file in our system.

First search works on eventtype-> Filename and Time of creation are the table fields
Second lookup data fields-> Filename and Transfer time

I want to combine the data of eventype search and lookup and display into one single table with combined fields like 

TIme of creation Filename Transfer Time 

How to achieve this I am pretty stuck on this issue

[hgoyal]

Hi @gcusello 

Thanks for the solution I used join too it is working 

[gcusello]

Hi @hgoyal,

you have to check if the filename is in the same format between main search and lookup, if yes, you can run a search like this:

index=your_index
| lookup your_lookup.csv Filename OUTPUT Transfer_Time
| table Creation_Time Filename Transfer_Time 

Ciao.

Giuseppe