I am doing a small proof of concept on lookup command.
I have a look up csv file with the table:
env status date prod up 7/21/2016 int up 7/20/2016 sit down 7/19/2016 qa down 7/21/2016 test down 7/20/2016 stage down 7/18/2016
Now I have setup the lookup definition (
lookup_try ) with global permission.
Then I try to run this command:
index=* |head 1|eval env="Prod"|lookup lookup_try env OUTPUT status date
It does not print the values of
date. Where am I going wrong?
Lookups are CASE-SENSITIVE by default (but there is a setting to make them case-insensitive). Try this (cut and paste exactly as is):
| noop | stats count AS env |eval env="prod" | lookup lookup_try env
I suppose you've tested this search before and you can see your CSV list:
| inputlookup lookup_try.csv
If ok, try this:
index=* |head 1|eval env="prod"|lookup lookup_try env OUTPUT status date