Is it possible to use a search value or a token in the outputlookup name?

[iKate]

Hi!

Is it possible to pass into lookup's name created by outputlookup command a token or a search value?

Smth like this:

index=foo 
| eval week=<here comes some evaluation, e.g. number of week>
| outputlookup dataset_$week$.csv

I've tried to write it differently, but outputlookup eats all sorts of symbols and just creates files with $ ' " ` in its name while I wanted dataset_15.csv

[ryanoconnor · Accepted solution]

The map command should be able to handle this. For example:

index=* host=sample_host | dedup host  | map search="search * | outputlookup $host$.csv"

[iKate]

Wow! It works, thank you!