How to match a result from 3 fields using an ambiguous lookup.
lookup client_type.csv
client_id type id id_type
82 AB-25 WWS-1 210 28000-CWS1
83 AB-25 WWS-2 210 28000-CWS2
The main search produces a client_id, and I need to join it to the results above.
As an example, client 82 and client 83 can both have id of 210.
... search with multiple client_id
| join type=left client_id [search index=client_source="updates.ids" earliest=-7d latest=now() | dedup Case sortby -_time | search CaseTitle="*CLIENT ID*" | rex field=CaseTitle "(?.*) CLIENT ID"
| eval id=if(!like(OBJ,"%.%"), upper(trim(OBJ)), null())
| lookup id OUTPUT id_type, _client_id
The problem I have is that the id is ambiguous, matching both WWS-1 and WWS-2.
My requirement is that it is OK for both entries to equal each other, but need out output each client_id in order to match the parent search. specifically client_id 82 and 83 can both match WWS-1 or WWS-2
Not sure how to fulfill.
