I have a two lookup files events_lookup and risky_events_lookup . I have the following search;
| inputlookup events_lookup.csv
| join [| inputlookup risky_events_lookup.csv | where risky_start_time<=start_time AND risky_end_time>start_time | stats count as
high_risk_events]
| eval high_risk_period=if(high_risk_events>0, "Yes", "No")
| table *
I am looking to see if any events are taking place while risky events are, the start_time field is from the events_lookup however I cannot get the search to work. The field start_time does not translate to anything within the subsearch so therefore high_risk_events is always equal to zero. Could use some pointers, thanks
