I have a search where I am doing 2 inputlookups for 2 different lookups and appending them. Then I search them. Can I table the lookup name as a field for where the result was found? Thanks.
From a nice bloke on reddit:
Example if you are using lookups normally:
| lookup my_lookup1.csv field1 OUTPUT outfield1 | lookup my_lookup2.csv field1 OUTPUT outfield2 | eval outfield = coalesce(outfield1,outfield2,"not found") | eval tablesource = case(isnotnull(outfield1),"my_lookup1.csv", isnotnull(outfield2),"my_lookup2.csv", true(),"not found")
Example if you are using inputlookup:
| inputlookup my_lookup1.csv | eval tablesource="my_lookup1.csv" | inputlookup my_lookup2.csv append=true | eval tablesource=coalesce(tablesource,"my_lookup2.csv")