Hi,
I have a requirement where I want to make a common error dashboard for a set of apps with a textbox. There is an Errorid field which has different values for different applications i.e Errorid can be ID for 1 application and racfid for another. So I have made a lookup where, for an Appid , I find out the corresponding Errorid .
Now if I write the following search:
index=_internal |lookup lookup_name Appid OUTPUT Errorid
This gives me the correct Errorid Fieldname (like ID) as the field value in the field Errorid (i hope I'm clear on this)
Now I want to somehow make this field value as the fieldname to search further like below:-
index=_internal |lookup lookup_name Appid OUTPUT Errorid|Errorid.value(like ID)=$textboxvalue$|and so on
Am i doing anything wrong? please advise
... View more