timechart data derived from lookup

[mcaulsc]

Hi,

I have data that contains a field in binary that i can use a lookup table to map the various binary values to a value that makes sense. That works fine:
chart count by TPTYPE|lookup ims_tptype_lookup TPTYPE OUTPUT trantype AS TPTYPE

However rather than a single column for each value over the entire interval I'd like to be able to show the counts per hour which is where I seem to be stumbling. I either get the original binary value or I get some errors in the search.

 bin _time span=1h |timechart count by TPTYPE|lookup ims_tptype_lookup TPTYPE OUTPUT trantype AS TPTYPE

Does what I want but the lookup doesn't happen in for the chart data, if I move the lookup before the timechart command I get errors.

Could anyone point me in the right direction please?

Steve

[mcaulsc · Accepted solution]

ah, found the issue, it goes back to permissions on the lookup. It must do something different between the ways the search is constructed. Even though it was just me testing the search when I changed the permissions on the lookup table and definition to READ for all in app it started to work.

Thanks again for your response.

[mcaulsc]

Thanks for the response, I now have:

lookup ims_tptype_lookup TPTYPE OUTPUT trantype AS TPTYPE |timechart count by TPTYPE span=1h

which gives me the following errors:

Streamed search execute failed because: Error in 'lookup' command: Could not construct lookup 'ims_tptype_lookup, TPTYPE, OUTPUT, trantype, AS, TPTYPE'

[bowesmana]

@mcaulsc 

A couple of things...

You don't need the bin command with timechart, as you can do

| timechart span=1h ...

however, after the timechart, you no longer have the TPTYPE field, only the values, so you have to do the lookup prior to the timechart. 

What errors do you get?

[isoutamo]

Can you remove bin _time span=1h and add span=1h to the timechart command.