Hi guys, So heres what im trying to do. I have a lookup csv with 3 columns. I have data with string values that might contain a value in my lookup. I have the basic setup working but i want to populate additional fields in my data set. Here is a very stripped down version of what i am doing. First I have a basic lookup csv. It has 3 columns:
active flagtype colorkey yes sticker blue yes tape red no tape pink
then my search which creates a couple test records looks like this:
| makeresults count=4
| streamstats count
| eval number = case(count=1, 25, count=2, 39, count=3, 31, count=4, null())
| eval string1 = case(count=1, "I like blue berries", count=3, "The sea is blue", count=2, "black is all colors", count=4, "Theredsunisredhot")
| table flagtype, flag, string1, ck
|search [ inputlookup templookup.csv
| eval string1 = "string1=" + "\"" + "*" + colorkey + "*" + "\""
| return 500 $string1
]
| eval flag = "KEYWORD FLAG"
| table flagtype, flag, string1, colorkey
my 4 column output results are:
flagtype flag string1 colorkey empty KEYWORD FLAG I like blue berries empty empty KEYWORD FLAG The sea is blue empty empty KEYWORD FLAG Theredsunisredhot empty
How do I populate the two empty columns using other columns in the lookup table.
Thanks in advance for any help I can get.
... View more
