I'm trying to create a search macro which accepts a field to match on and enriches the results with matches and outputs those enriching fields appending the matching value's matching field name as the new field names.
For example:
`my_macro(sourceAddress)`
Should output the following field names (if it matches):
sourceAddress_WHOIS sourceAddress_Severity sourceAddress_lastCheck
Where WHOIS, Severity, and lastCheck are field names in the lookup table.
This should also exhibit the same behavior, dynamically, for `my_macro(destinationAddress)`:
destinationAddress_WHOIS destinationAddress_Severity destinationAddress_lastCheck
This macro may be called multiple times against multiple field names in a single search. destinationAddress, sourceAddress, clientAddress, proxyAddress, and more are all potential field names in the searches this macro would be used for and multiple combinations of each can potentially exist in each result. I'd like to be able to clearly see which fields were enriched by the lookup table, if enrichment occurred.
... View more