Hi team,
I am trying to send earliest and latest time values from lookup to saved search but i am not able to get results for the same.
Lookup:
| inputlookup temp.csv
Result:
arg1 | arg2 |
1607395500 | 1607396400 |
1607395500 | 1607396400 |
1607395500 | 1607396400 |
Search with direct values:
| inputlookup temp.csv
| append [search index=abc earliest="1607395500.000" latest="1607396400.000"]
Result:
Getting proper result.
search using lookup fields:
| inputlookup temp.csv
| append [search index=abc earliest=arg1 latest=arg2]
Result:
Invalid value "arg1" for time term 'earliest' and "arg2" for time term 'latest'
Note: Let me know if you need any other from my side.
What is the desired result of this query?
I see two problems so far:
1) inputlookup returns 3 values for arg1 and arg2, but the earliest and latest options only accept one value (each).
2) The search command does not accept fields on the right side of the =.
If each row in the lookup file is supposed to generate a search then try this:
| inputlookup temp.csv
| map search="index=abc earliest=$arg1$ latest=$arg2$"