Hello Everyone
I am trying to see if i can pass an event field over to a lookup attached with a wildcard (reverse lookup from event filed) ? For this an example I will use the items below
table = user_table.csv
lookup = user_table_loookup
user_table.csv data below:
email, manager_name
user1@domain_1.com, "Doe, John"
I have an event field within an index of . I then have a lookup table (.csv) that contains a column email and manager_name* within the user_table_loookup.
Is it possible to attach a wildcard to the username filed and send it against the lookup table to match the username portion of the email and return the manager_name from the lookup?
index=index_1 username=user1 | lookup user_table_loookup email AS username OUTPUT manager_name
username >> email
user1 >>>> user1@domain_1.com
