I want to check data from two different lookup tables and relate it using multisearch command.
I have a case where I have several lookup tables which I want to join on the same key. I use append
to make the union of all the events, then use | stats values(*) as * by key
to combine them back to a single event per key, with the union of all the lookup values. For my data volume, this works well.
| inputlookup file1.csv where condition
| append [ | inputlookup file2.csv where condition]
| append [ | inputlookup file3.csv where condition]
| stats values(*) as * by key
If you are consulting two lookup tables, it's unlikely that you need multisearch
. You can string multiple lookup commands in a single query. Can you tell us more about what you're trying to do, and we can suggest a good approach?