Hi,
I am trying to do the following:
1. Using this | inputlookup Application.csv where BusinessUnit = BU1, it will filter a list of Account Codes e.g. AC1, AC2, AC3
2. I want to use that list of Account Codes to filter my search on a different sourcetype.
index=index1 sourcetype=sourctypeN ACCOUNT_CODE = "AC1" or ACCOUNT_CODE "AC2" and so on..
Thanks!
Put the two searches together like this:
index=index1 sourcetype=sourctypeN [ | inputlookup Application.csv where BusinessUnit = BU1 | return 1000 ACCOUNT_CODE ]
Put the two searches together like this:
index=index1 sourcetype=sourctypeN [ | inputlookup Application.csv where BusinessUnit = BU1 | return 1000 ACCOUNT_CODE ]