I have requirement where i need to search eventtype which are present in my lookup table, say in lookup i have one column name called "eventtype" and other column "Status" value as pass or Fail
eventtype Status xyz pass abc Fail
So in my final result i want the all indexed data with eventtype "xyz"
Below is what i tried but its not working
index=myindex sourcetype=aa [ | inputlookup myfile.csv where Status ="pass"| table eventtype ]
Can any one help me on this?
If you define your lookup to be automatic (Settings -> Lookups -> Automatic Lookups) for that sourcetype inputting
eventtype and outputting
Status, you will be able to search like this:
index=myindex sourcetype=aa Status=pass
Thanks for reply
For doing automatic lookup we need to have unique field values from both the set (index data and lookup data) but in my case each event is tag to multiple eventtype. so how to do this ? in automatic lookup?
By default, an automatic lookup will produce up to 1000 matches.
Are you trying to tag eventtypes? If so, have you looked at assigning actual tags for those eventtypes?
eventtypes are a search-time-only construct so what you are asking (something index-time based on
eventtypes) is utterly impossible. Perhaps I am being "too literal" and I might have a better/different answer if you rephrased your question.