Two lookup commands in one search

[dewald13]

I am trying to use two lookup commands in one search string. The output of the first lookup command is being used in the second lookup.

index=proxysg | lookup myfile.csv A as B output C | lookup otherfile.csv D as C output E

The output of the first lookup, "C", is being used in the second lookup with a new output from the second lookup file, "E".

Is this even possible?

[dewald13]

I am now using the following search, still with no luck..

index=proxysg | lookup bases range as client_ip output base | lookup inosc BASE as base output NOSC

Ideas why its not working?

[Ayn]

I second alacer's idea - it's a good thing to break your search down into individual parts that you can troubleshoot one by one instead of just writing the whole search and trying to debug the whole thing all at once.

That being said, it's very common that people confuse the "as" directive in lookups (which is totally understandable because it's very counter-intuitive). "A as B" means that the field in the lookup should be "A" and the field being aliased is "B" - not the other way around.

Reading your example once again I'm pretty sure this is the case in your search. You're outputting "C as D" which means that the field "D" in the lookup will be output as "C" in your search. You then try to lookup the field "D" in your next lookup, but as D doesn't exist (but C does) that lookup will fail.

[dewald13]

That makes sense but since my first post, I am now using this search string;

index=proxysg | lookup myfile.csv A as B output C | lookup otherfile.csv D as C output E

So, the output from the first string "C", is being used as the alias for the second string.

Yes/no?

[alacercogitatus]

Yes, it is exactly like that. Are you getting results you didn't expect?

index=proxysg | lookup myfile.csv A as B OUTPUT C as D | lookup otherfile.csv D OUTPUT E

[dewald13]

I am getting the correct output from the first lookup

[alacercogitatus]

Try doing the first part to verify that you are getting expected results from the first lookup. index=proxysg | lookup myfile.csv A as B OUTPUT C as D

[dewald13]

I am only getting the output from the first lookup, "D". It seems like it is ignoring the second lookup all together but there is no way I can test the second lookup by itself since it relies on the output from the first lookup. Make sense??