search with parameters

[sarit_s]

Hello,

I have this query:

index=prod eventtype="csm-messages-dhcpd-lpf-eth0-listening" OR eventtype="csm-messages-dhcpd-lpf-eth0-sending" OR eventtype="csm-messages-dhcpd-send-socket-fallback-net" OR eventtype="csm-messages-dhcpd-write-zero-leases" OR eventtype="csm-messages-dhcpd-eth1-nosubnet-declared"
| transaction maxpause=2s maxspan=2s maxevents=5
| eval Max_time=(duration + _time)
| eval Min_time=(_time)
| table _time,eventcount, eventtype ,Min_time, Max_time,tail_id,kafka_uuid
| foreach eventtype
    [eval flag_eventtype=if(eventcount!=5,"no", "yes")]

now i have a lookup table and i want to set parameters in my query that will be taken from the lookup table.
for example , instead of searching

eventtype="csm-messages-dhcpd-lpf-eth0-listening" OR eventtype="csm-messages-dhcpd-lpf-eth0-sending" OR eventtype="csm-messages-dhcpd-send-socket-fallback-net" OR eventtype="csm-messages-dhcpd-write-zero-leases" OR eventtype="csm-messages-dhcpd-eth1-nosubnet-declared"

i want to take the values of the eventtype from the lookup table

how can i do that ?

thanks

[kamlesh_vaghela]

@sarit_s

Try

index=prod [ |inputlookup myLookup | table eventtype] | YOUR REST SEARCH

[sarit_s]

Hey, thanks for your answer..
my lookup table has 10 different columns that calls UsedRule1...UsedRule10
eventtype should be each one of the UsedRole in the lookup

[efika]

The end result of the subsearch should be a table with a column that is named "eventtype" and values that should be what you are searching for.
based on what you are describing you might need to transpose the results of the inputlookup

[sarit_s]

im not sure i understood what you are saying...

this is how my table looks like :

AlertNameNonUnique AlertNameUnique AlertSevirityNonUnique AlertSevirityUnique UsedRule1 UsedRule10 UsedRule2 UsedRule3 UsedRule4 UsedRule5 UsedRule6 UsedRule7 UsedRule8 UsedRule9

how can i use this values as parameters in my query ?

[efika]

Try this in the subsearch:
| inputlookup
| fields Used*
| transpose
| rename "row 1" as eventtype
| fields eventtype

[sarit_s]

@efika
thanks, it is working but it is not allowed me to be dynamic.
what if my file will contain more than one row ?
also, not all the values in "row 1" are eventtypes.. how can i use the values from the file as arguments ?

[efika]

Hi Sarit,

Do a subsearch, get all the lookup values into a Multi Value field (MV) and compare the eventtype in the outer search to this MV.

[sarit_s]

hi, thanks for your answer...

i know the algorithm, i just don't know how to apply it