Hello,
I want to know if it is possible to use a join command with inputlookup instead of a lookup to join data between an index and a lookup table.
Example;
Index=firewalls |join type=inner overwrite=false dstip [inputlookup maliciousIP.csv] |stats count srcip by dstip, malwareName
| join type overwrite=false srcip [inputlookup UserIP.csv] |table count, dstip, malwareName, srcip, username,
The UserIP.csv is generated every hour after this the search will run.
Fyi this is not the exact search, but just an example. The reason I want to use join instead of lookup is that the lookup list has many additional columns and I want to keep the search as simple and short as possible and want to get some input to see how others handle this..
Hope to get some ideas from this.
