inputlookup followed by transaction - No results found

[landen99]

So I do the following search:

| inputlookup x | transaction y

y and z are a fields in lookup table x but the search returns with: No results found.
Adding table * and format commands before transaction do not help. Removing transaction yields the table normally.

I want to understand why transaction does not work and how to make it work.

[chanfoli · Accepted solution]

The purpose of the transaction command is to group events based on constraints. It expects to be operating on events containing raw and time fields as well as the field(s) you want to constrain it with. It sounds like you are asking transaction to operate on a table of results which do not have all of the typical event fields. Depending on what you are doing before the first pipe above, perhaps you could get this to work by using append=true on the inputlookup command to preserve the actual event fields. It might help to see example results from your inputlookup to confirm what the problem is.

[landen99]

You reminded me that transaction requires _time so I added it:

 | inputlookup x | eval _time=now() | transaction y

.. and it worked! Thank you.

[mhergh]

great, your example showed that all that you need is to set the _time ... Worked for me too like a charm, many many thanks!!!