I have an index=foo and a lookup table defined as foo2. How can I compare my index to the table to show only results matching fieldA in foo2 and pulling fieldB from foo2?
I have tried below and many variations of it but I get no results.
index=foo
[| inputlookup foo2 | fields fieldA]
index=foo
| lookup foo2 fieldA OUTPUT fieldB
Ultimately, you should be able to do:
index=foo
| lookup foo2 fieldA AS fieldA_name_in_foo OUTPUT fieldB
| where NOT isnull(fieldB)
Ultimately, you should be able to do:
index=foo
| lookup foo2 fieldA AS fieldA_name_in_foo OUTPUT fieldB
| where NOT isnull(fieldB)
Why did you add the not null for fieldB?
The lookup simply adds fieldB to events in index=foo where fieldA is matched. If fieldA is not matched, the event still shows up, but fieldB is null. Therefore the not isnull fulfills the "show only results matching fieldA in foo2" requirement.
Oh, and thanks btw.
Is fieldA the same name in foo and foo2?
Not necessarily. But since it is different you will need to rename fieldA to what it is in foo:
index=foo
| lookup foo2 fieldA AS fieldA_name_in_foo OUTPUT fieldB
I had a typo on my end. It works.
Sweet we are getting somewhere! I got the output of fieldB but results are still showing all results of fieldA not just what populates compared to the lookup table. <--does that make sense?
No. It is not. Should it be?