Hi, I have following data which I use search to find from last 30 days and save it into lookup:
| Customers | Old Acquired Product | New Acquired Product |
| Jack | Product 1 | Product 2 |
| Alan | Product 4 | Product 5 |
| Chris | Product 3 | Product 2 |
| Ceb | Product 5 | Product 3 |
Now, I know every day or every few days each customers products are changing as they are acquiring new products. Here is what I want to do:
For e.g. next day customer Jack and chris acquired new product. So saved search schedule will pick up the change and update the lookup as follow:
| Customers | Old Acquired Product | New Acquired Product |
| Jack | Product 2 | Product 4 |
| Alan | Product 4 | Product 5 |
| Chris | Product 3 | Product 2 |
| Ceb | Product 3 | Product 2 |
i know i have to use outputlookup and lookup command but i have fear it is going to overwrite it.
Yes, outputlookup will update the store - you possibly want to merge the current store with the results from the search which is finding the updates, then output the whole store
| inputlookup store.csv
| append
[ search for new state ]
| outputlookup store.csv append=f
However it will have duplicate values which I would like to avoid. Otherwise lookup file will be huge.
| stats latest(oldproduct) as oldproduct latest(newproduct) as newproduct by customeridThis way you only keep a single event for each customerid (assuming you are using append=f on the outputlookup)