Hi,
I am having trouble using lookups. I have four fields in a csv file error_code,criticality, service,service_type,Info
My events in logs have fields extracted error_code,service,service_type. Now my reqirement is if an error_code with specific service and service_type should print that particular Info.
I tried this query:
sourcetype="lookup-test" | stats count by error_code,service,service_type,buis_proc | lookup error_code error_code as error_code service as service service_type as service_type OUTPUT Info as description.
But I am unable to get the description for all the entries. Please help
error_code service service_type buis_proc count description
1 100 CARDSERVICES RED STATUS_UPDATE 1 contactRED
2 101 WALLET LEDGER BALANCE_ENQUIRY 1
3 200 CARDSERVICES VISA STATUS_UPDATE 1
4 201 CARDSERVICES RBS STATUS_UPDATE 1 contactRBS
5 202 WALLET LEDGER BALANCE_ENQUIRY 1
6 203 CARDSERVICES NUCLEUS STATUS_UPDATE 1
7 205 CARDSERVICES GANDD STATUS_UPDATE 1
8 206 WALLET LEDGER BALANCE_ENQUIRY 1
9 207 CARDSERVICES VISA STATUS_UPDATE 1
10 300 WALLET LEDGER BALANCE_ENQUIRY 1
... View more