I have a problem when searching my lookup field. I added a lookup file to my search with 3 fields (Vulnerability, Risk, Reference). But when I'm searching with stats command or something else it shows me a different result.
Are there any solutions?
could you share your search?
Anyway check the file names and put a special attention to the cases of your values that could not match and if there are duplicate values!
Do have bit more detail about how you are calling the lookup and what your report looks like? i.e is this an automatic lookup or are you calling in within the report
which fields have you mapped with automatic lookup ? When you try to search
stats command, are you able to see Vulnerability ,Risk,Refrence fields on left hand side as
yes.i can see them in right pannel.but when i search them it shows different result.not showing the exact number
sourcetype=csv | stats count by Vulnerability Risk Refrence