Hi
I have a lookup having two fields
| inputlookup ID-Client-Lookup.csv | fields ClientId ClientName
I have a base search
sourcetype="oxygen-standard"
| regex AllClientIDs="^[a-z0-9A-Z]{2,}$"
| stats count by AllClientIDs
I want a query which will take each ClientIDs from my base search and the search in the lookup and give me the Client Names
Can anyone help?
sourcetype="oxygen-standard"
| regex AllClientIDs="^[a-z0-9A-Z]{2,}$"
| stats count by AllClientIDs
| lookup ID-Client-Lookup.csv ClientID as AllClientIDs OUTPUT ClientName
It says error in lookup command. Cannot find the source field 'AllCliendID' in the lookup table 'ID-Client-Lookup.csv'.
Check the spelling of the field names. The one used in the lookup command must be the same one produced by stats. I did get the order of arguments wrong, however. Check my modified answer.