Hi @splunkettes  Please guide how you created the custom search command similar to outputlookup command.    ... View more

@kamlesh_vaghela Raw event: {"issues":[{"changelog":{"histories":[{"author":"ABC","created":"123"},{"author":"XYZ","created":"456"}]},"fields":{"project":"test1"},"id":"1"},{"changelog":{"histories":[{"author":"ABC","created":"1234"},{"author":"XYZ4","created":"456"}]},"fields":{"project":"test1"},"id":"2"},{"changelog":{"histories":[{"author":"ABC2","created":"1232"},{"author":"XYZ2","created":"4562"}]},"fields":{"project":"test12"},"id":"3"}]} ... View more

Hello, Thank you for your quick response! As for your queries: The default fields i am getting are given as below: issues{}.fields{}.project, issues{}.changelog.histories{}.author, issues{}.changelog.histories{}.created, issues{}.id i tried using spath but i guess it will not be able to help much as i already have the required fields. It is just that that i am unable to correlate these field values as per the json. json in text: *{ issues: [ { changelog: { histories: [ { author: ABC created: 123 } { author: XYZ created: 456 } ] } fields: { project: test1 } id: 1 } { changelog: { histories: [ { author: ABC created: 1234 } { author: XYZ4 created: 456 } ] } fields: { project: test1 } id : 2 } { changelog: { histories: [ { author: ABC2 created: 1232 } { author: XYZ2 created: 4562 } ] } fields: { project: test12 } id: 3 } ] }* ... View more

Hello, Thank you for responding ! Since my input is in tabular format, i am not sure if i can use this. If i wish to use this procedure then how will i convert my tabular data to the format given below : " eval raw="A=1,email=abcd@xxxx A=2,email=efgh@xxxx A=3,email=xyza@xxxx A=4,email=mno@xxxx A=5,email=pqrs@xxxx B=3,name=ijk B=5,name=lmn"" ... View more

Hello richgalloway, Yes, the two parts of the join are working as expected. ... View more

Thank you for the quick response! mysearch & mysearch2 are detailed out below: index="index1" host="host1" source="source1" sourcetype="json" | head 1 | spath output=object path=data.users{} | foreach object [ spath output=number path=data.users{}.number | spath output=email path=data.users{}.email] | table number, email | join number type=outer [ search index="index2" host="host2" source="source2" sourcetype="csv" "somekeyword" | table name, number1 | rename number1 as number ] | table number, email, name Please let me know the possible resolution. ... View more

Thank you for the quick response! I tried your resolution but it didn't work for me. Please have a look at the exact query: index="index1" host="host1" source="source1" sourcetype="json" | head 1 | spath output=object path=data.users{} | foreach object [ spath output=number path=data.users{}.number | spath output=email path=data.users{}.email] | table number, email | join number type=outer [ search index="index2" host="host2" source="source2" sourcetype="csv" "somekeyword" | table name, number1 | rename number1 as number ] | table number, email, name Here i have tried using outer join also. Please let me know the possible resolution. ... View more