How to join log file with a lookup file?

[poojamande]

I have indexed one log file in which Job name, job status and time are the fileds. Also, I have one lookup file which is having the job name and its upstream and downstream, sla information etc. Need to join the static lookup file with real time indexed log file.
eg. |inputlookup FeedLookup1.csv |join JobName [search index=feed sourcetype=autosys|fillnull value=NA |table JobName]| table JobName, status
Here I don't get any data from log file. Results populates only from lookup file.
Please suggest.

[sundareshr · Accepted solution]

Depending on what you're looking for, you may not need to join the two. If you want the upstream and downstream sla based on JobName, you should use the lookup command. Try this

`index=feed sourcetype=autosys|fillnull value=NA |` lookup JobName as JobName OUTPUT upstream_sla AS upstream_sla downstream_sla AS downstream_sla | table JobName *sla status

Make sure field names and values are identical between log file and lookupfile.

If you are only interested in returning Jobs from the log file, that have a corresponding entry in the lookup file, try this

index=feed sourcetype=autosys [inputlookup lookupfile.csv | table JobName] | ...