Any suggestions how the query can be improved
This returns no events as of now.
In the lookup csv Im having UserId and Name as two columns.
index=123 AND organizationId=00TY00000005677 AND logRecordType=ailtn (Lightning_Console) | dedup sessionKey | lookup test123.csv UserId AS userId OUTPUT UserId AS userId | table userId, sessionKey, _time
What would you like to do with lookup command here?
Lookups are used to enrich event information.
you are matching userid from events and lookup and again you are trying get userid from lookup. Were you trying to get name for userId?
have a look at below video.
index=123 organizationId=00TY00000005677 logRecordType=ailtn (Lightning_Console)
| stats earliest(_time) as session_start latest(_time) as session_end by sessionKey,userId
| lookup test123.csv UserId AS userId OUTPUT Name
| convert ctime(*time) timeformat="%d/%m/%Y %T"