Is it possible to do eval and lookups with makeresult?

[Thulasinathan_M]

Is it possible for me to do a main search and based on the results from main search I find the fileName and want to use it in the inputlookup for a sub-search. I'm using this on dashboard as well, so doing it by map is waiting for inputs in dashboard and never getting populated.

Lookup with map:

index=main Events
| stats count, Events
| eval fileName= <filename>
| eval lookup="| inputlookup ".fileName
| map search="| makeresults | map search="$lookup$

My Current search query:

index=main Events
| stats count, Events
| eval fileName= <filename>
[| inputlookup [| makeresults 
                  | eval search=fileName 
                  | table search]] | stats count as known by Events
| fillnull known values=0
<remaining search>​

[ITWhisperer]

As I have told you before, fields from the outer search are not available to the subsearch because the subsearch is executed first.

Having said that, since you are using a dashboard, you may be able to use a base search, and set a token in the done handler of the base search, which you can then use in the panel search

[Thulasinathan_M]

Hi @ITWhisperer , Thanks. Used Tokens and it done the trick.
I try to push these results to a summary index, and will keep on doing this only if the event is not already present in summary index but I want to maintain the count of this events as well. It seems impossible to maintain unique event in summary index and keep on updating the count of events. Could you kindly suggest a solution for this please.

[ITWhisperer]

You should check out my talk on Summary index idempotency