Hi,
I´m trying to lookup different csv-files depending on an field-Value.
But it seems to be a problem for the lookup command to handle an variable as lookup-csv-file.
index=yxz
| search model="123"
| eval lookupfile=case(model == 123, "123_lookup.csv", model == 456, "456_lookup.csv", model == 789, "789_lookup.csv")
| lookup lookupfile ErrorCode
I´m getting this Error Message:
Error in 'lookup' command: Could not construct lookup 'lookupfile, ErrorCode'. See search.log for more details.
Can someone help me with this?
The only way I ever got this "case for dynamic lookups" to work was by using a dashboard and setting a token with the eval in a drop down, and then I used the token in my search in my dashboard panel.
I'm pretty sure lookup
won't take a field name, but try this before giving up.
| lookup 'lookupfile' ErrorCode