I try to use lookup to specify span option value in bin command with map
| inputlookup mylookupup.csv
| fields Index, SearchString ,Tdiv | map
[ search index="$Index$" _raw="*$SearchString$*"
| bin span="$Tdiv$" _time]
The previous request fails with :
Error in 'bin' command: The value for option span (Tdiv) is invalid. When span is expressed using a sub-second unit (ds, cs, ms, us), the span value needs to be < 1 second, and 1 second must be evenly divisible by the span value.
Example of values in Tdiv field :
could you help me with this problem?
I think I've seen this somewhere. For some reason map sometimes behaves differently if the search is specified in square brackets and differently if it's passed as parameter to the search= option.
Try the latter form (remembering about proper escaping)
| inputlookup mylookupup.csv
| fields Index, SearchString ,Tdiv | map search="search index=\"$Index$\" _raw=\"*$SearchString$*\"
| bin span=\"$Tdiv$\" _time"