I have a lookup table that contains usernames and userids. I want to use this to match a username to userid & vice versa. I want to take the output from said lookup and search across multiple indexes for the username OR the userid. It would look ruffly something like this:
|inputlookup username2userid.csv
| search username=a@a.com
| table username userid
| search (index=a $username$) OR (index=b $userid$)
If I manually replace either variable with the actual values the search works. Is it not possible to pass a variable from a lookup into a search?
Thank you in advance!
Please try
| inputlookup "username2userid.csv"
| search username=a
| table username, userid
| map search="search index=a $userid$"
this should works
Hi
basically you have two options:
It depends on your event amounts etc. which one is better.
r. Ismo
1. Thank you for the response. I'm getting the following error when using the map command:
Unable to run query '(index=a "<REDACTED>") OR (index=b "<REDACTED>")'
I don't see anything in the search.log that is causing errror and I've tried specifying fields for both variables.
If I only search one index with one variable I get a similar error.
SEARCH:
| inputlookup "username2userid.csv" |search username=a
| table username, userid
| map search="index=a $userid$"
ERROR:
Unable to run query 'index=hyperion "<REDACTED>"'
2. I'm unsure what you mean by "Switch the order to reverse and use sub queries to get those username and userid". May I have an example please?
Please try
| inputlookup "username2userid.csv"
| search username=a
| table username, userid
| map search="search index=a $userid$"
this should works
That was it! Thank you for your help!