|inputlookup |eval duration="xyz"|append[inputlookup |eval duration2="abc"]|eval dur3=duration-duration2| table dur
Here, the query is taking value of only the first lookup and not the second one. As a result, I don't get the final table with the value that I require. How to solve this?
I think Pipe missing in second
inputlookup is the reason why you do not have data from second csv. As you were able to pull up data from first lookup file I believe lookup file names have been omitted on purpose.
However, what I dont understand is the purpose of adding duration and duration2 to your two lookups? Rather than that, you can directly add dur3 as the static value that you need.
Also, can you add the content of the two lookup files? Do they have same values being correlated? Please add more information for us to assist you better.
I am bit confused by your query. As you are doing subtraction, I am assuming that it is a numerical field.
| inputlookup filename.csv | eval duration="xyz" | append [| inputlookup filename1.csv | eval duration2="abc"] | eval dur3=duration-duration2 | table dur
Also the syntax of lookup is
| inputlookup <yourcsv>
If this does not give you solution. kindly provide sample input as well as let us know which all csv file are there in the query.
let me know if this helps!
append, it's just appending the values to the bottom of the first search. doing a subtraction won't work because there will be nothing on the duration2 column next to the duration1 column until you merge them together.
you could try to use
join if there is a field to join the two lookups together, just as an ID. otherwise, you could try using
the other option is using
stats somehow to join.
let's say you have two lookups:
answers_duration 5 10 20
then to calculate the value youwould do this:
| inputlookup answers.csv | appendcols [| inputlookup answers2.csv] | eval duration=answers_duration-answers2_duration