Using lookup tables and searching it twice

[rmorlen]

We have a user lookup table that contains information such as username, email, and managername. I can do a lookup to find a user's managername.

| inputlookup userlookup | search username="bob" | fields username, email, manager

From that I would like to get the email address for the manager. Something like:

| inputlookup userlookup | search username="bob"| fields manager | rename manager AS empManager | search [| inputlookup userlookup username=empManager]

Which doesn't work because the syntax is all screwed up (and I'm not good with lookup tables).

[sc0tt · Accepted solution]

I think something like this should work:

..search | fields username
| lookup userlookup username OUTPUT manager
| lookup userlookup username as manager OUTPUT emailaddress

Since you have the manager name in the lookup table, it may be a good idea to just include an additional field with the manager's email.

[rmorlen]

Thank you. That worked.