I am doing a small proof of concept on lookup command.
I have a look up csv file with the table:
env status date
prod up 7/21/2016
int up 7/20/2016
sit down 7/19/2016
qa down 7/21/2016
test down 7/20/2016
stage down 7/18/2016
Now I have setup the lookup definition ( lookup_try
) with global permission.
Then I try to run this command:
index=* |head 1|eval env="Prod"|lookup lookup_try env OUTPUT status date
It does not print the values of status
and date
. Where am I going wrong?
You can make lookup search case insensitive by adding case_sensitive_match =false in your lookup stanza.
You can make lookup search case insensitive by adding case_sensitive_match =false in your lookup stanza.
Lookups are CASE-SENSITIVE by default (but there is a setting to make them case-insensitive). Try this (cut and paste exactly as is):
| noop | stats count AS env |eval env="prod" | lookup lookup_try env
are you sure of the name of the lookup? its name is lookup_try or lookup_try.csv?
You can try it with | inputlookup command
| inputlookup lookup_try.csv
Bye.
Giuseppe
Hi!
I suppose you've tested this search before and you can see your CSV list:
| inputlookup lookup_try.csv
If ok, try this:
index=* |head 1|eval env="prod"|lookup lookup_try env OUTPUT status date
Regards.