I have a lookup table set up like
lookup table name A1_timer
field_a filed_b
test1 value1
test2 value2
source A1 looks like
field_A = test1 field_B = foo field_C = bar
I would like my output to look like:
field_A from source A1, field_b from lookup table A1_timer, field_B from source A1, field_C from source A1
source="A1.txt" lookup A1_timer A1_a OUTPUT A1_A A1_timer_b A1_b A1_c
the value in the source file A1.txt in filed A1_a is equal to lookup table A1_timer value A1_timer_a
I'm also getting sourcetype too small on my lookup table
any ideas?
There are some field name inconsistencies between your description and your example...
Based on your description, try this:
source="A1.txt" | lookup A1_timer field_A AS field_a | table field_A field_b field_B field_C
Three separate steps: search, lookup, and formatting.