Hi, LOOKUP-asset_lookup = server_summary host OUTPUTNEW serveros AS asset_os I have a lookup where serveros is one of the field asset_os is one of the enriched field from serveros Now, I need o...
See more...
Hi, LOOKUP-asset_lookup = server_summary host OUTPUTNEW serveros AS asset_os I have a lookup where serveros is one of the field asset_os is one of the enriched field from serveros Now, I need one more field called os (for datamodelling) which is same as asset_os I tried below but its not working out ( I need both asset_os and os field) 1) I tried asset_os as os in field alias --> didnt work 2) I created a calculated field, case(isnotnull(asset_os),asset_os,1==1,"unkown") - asset_os is not showing in fields 3) I added the below line into props.conf - Also here asset_os is not showing in fields LOOKUP-asset_lookup1 = server_summary host OUTPUTNEW serveros AS os Is there any other way I can get both asset_os and os field in the fields? We cannot go for field extraction as the required field value is not available in logs, the value is taken from lookup table.