Hi, I have following data which I use search to find from last 30 days and save it into lookup:
Customers | Old Acquired Product | New Acquired Product |
Jack | Product 1 | Product 2 |
Alan | Product 4 | Product 5 |
Chris | Product 3 | Product 2 |
Ceb | Product 5 | Product 3 |
Now, I know every day or every few days each customers products are changing as they are acquiring new products. Here is what I want to do:
For e.g. next day customer Jack and chris acquired new product. So saved search schedule will pick up the change and update the lookup as follow:
Customers | Old Acquired Product | New Acquired Product |
Jack | Product 2 | Product 4 |
Alan | Product 4 | Product 5 |
Chris | Product 3 | Product 2 |
Ceb | Product 3 | Product 2 |
i know i have to use outputlookup and lookup command but i have fear it is going to overwrite it.
Yes, outputlookup will update the store - you possibly want to merge the current store with the results from the search which is finding the updates, then output the whole store
| inputlookup store.csv
| append
[ search for new state ]
| outputlookup store.csv append=f
However it will have duplicate values which I would like to avoid. Otherwise lookup file will be huge.
| stats latest(oldproduct) as oldproduct latest(newproduct) as newproduct by customerid
This way you only keep a single event for each customerid (assuming you are using append=f on the outputlookup)