I would like to do a search using 2 columns in a lookup table where the row is AND'd. Something like
Col1 | Col2 |
A | 1 |
B | 2 |
C | 3 |
D | 4 |
where the search would be equivalent to
index=myindex (Col1=A AND Col2=1) OR (Col1=B AND Col2=2) OR (Col1=C AND Col2=3) OR (Col1=D AND Col2=4)
Try this
index=myindex [ | inputlookup yourlookup.csv | table Col1 Col2 ]
You can see the effect of the subsearch by running just this command
| inputlookup yourlookup.csv | table Col1 Col2 | format
Hope this helps
Try this
index=myindex [ | inputlookup yourlookup.csv | table Col1 Col2 ]
You can see the effect of the subsearch by running just this command
| inputlookup yourlookup.csv | table Col1 Col2 | format
Hope this helps
@bowesmana thanks. It looks like it works.
I was getting some errors with this answer initially, but it was because my actual search has a rex statement right before the inputlookup line. I found the putting a "| search *" between the two fixed the error.