@waleeper You're real close. Your inputlookup needs to be in a search on its own, that results in exactly the key/value pair needed for the main search. I don't have your lookup file, so I fake one and then bring it to the key/value pair you need to start the real search. Here's the run anywhere example that results in tag::host=sitecode, which you're looking for when Charlotte is entered:
| noop
| stats count
| eval raw=split("sitecity=Charlotte sitecode=clt ; sitecity=NewYork sitecode=nyc ; sitecity=Rochester sitecode=roc",";")
| mvexpand raw
| rename raw as _raw
| extract auto=t
| search sitecity="Charlotte"
| eval "tag::host"=sitecode
| table "tag::host"
To use this in brackets in your search, it might look like this:
[| inputlookup market-mapping
| search sitecity="Charlotte, NC"
| eval "tag::host"=sitecode
| table "tag::host"] index=data sourcetype=searchdata "string"
What's happening here, is the search in the brackets is resolving first. When it runs, the search resolves to:
tag::host=clt index=data sourcetype=searchdata "string"
... View more
