Let's not confound different matters. The original problem has nothing to do with id_num, filldown, or any other subject. No other data characteristics were described. The only information about d...
See more...
Let's not confound different matters. The original problem has nothing to do with id_num, filldown, or any other subject. No other data characteristics were described. The only information about data is filter ( fail_msg1 OR fail_msg2). Let's focus on this and raise a separate question about id_num. The big question about the search is: Does this pick the correct events? index="demo1" source="demo2"
[inputlookup sample.csv
| fields FailureMsg
| rename FailureMsg AS search
| format] To help you answer this, edit your sample.csv to ONLY include fail_msg1 and fail_msg2. Use this lookup to run the search in a fixed interval, e.g., earliest=-1d@d latest=-0d@d. Then, run the other search in the same fixed interval: index="demo1" source="demo2" ("fail_msg1" OR "fail_msg2") Do you get the same events? In fact, run a third test in the same interval (as long as you run all searches within the same @Day). index="demo1" source="demo2"
[makeresults format=csv data="FailureMsg
fail_msg1
fail_msg2"
| rename FailureMsg AS search
| format] If you get the same events from all three, and your id_num is blank, you should look at the events themselves to find why your regex won't work. In other words. Because the inputlookup subsearch has no way to influence any operation after events are returned. We can discuss further if ("fail_msg1" OR "fail_msg2") gives drastically different events from the other two. In that case, you will need to show raw events returned from each and explain what differences are between two groups of events. (Anonymize as necessary.) Here is a look at why I am suggesting these tests. Just take the kernel of those two subsearches without index search: | inputlookup sample.csv
| fields FailureMsg
| rename FailureMsg AS search
| format and | makeresults format=csv data="FailureMsg
fail_msg1
fail_msg2"
| rename FailureMsg AS search
| format Both will give you search ( ( fail_msg1 ) OR ( fail_msg2 ) ) This is why I am confident that the subsearches are identical to ("fail_msg1" OR "fail_msg2").