Need help in lookups

[shiva_kolachala]

Hi,

I am having trouble using lookups. I have four fields in a csv file error_code,criticality, service,service_type,Info

My events in logs have fields extracted error_code,service,service_type. Now my reqirement is if an error_code with specific service and service_type should print that particular Info.

I tried this query:
sourcetype="lookup-test" | stats count by error_code,service,service_type,buis_proc | lookup error_code error_code as error_code service as service service_type as service_type OUTPUT Info as description.

But I am unable to get the description for all the entries. Please help

error_code service service_type buis_proc count description

1 100 CARDSERVICES RED STATUS_UPDATE 1 contactRED

2 101 WALLET LEDGER BALANCE_ENQUIRY 1

3 200 CARDSERVICES VISA STATUS_UPDATE 1

4 201 CARDSERVICES RBS STATUS_UPDATE 1 contactRBS

5 202 WALLET LEDGER BALANCE_ENQUIRY 1

6 203 CARDSERVICES NUCLEUS STATUS_UPDATE 1

7 205 CARDSERVICES GANDD STATUS_UPDATE 1

8 206 WALLET LEDGER BALANCE_ENQUIRY 1

9 207 CARDSERVICES VISA STATUS_UPDATE 1

10 300 WALLET LEDGER BALANCE_ENQUIRY 1

[_d_ · Accepted solution]

Try this a let us know what the result is? (I am assuming that you have defined the lookup in your transforms.conf and the stanza name is error_code)

sourcetype="lookup-test" | stats count by error_code,service,service_type,buis_proc | lookup error_code error_code service service_type OUTPUT Info