Hello,
I have recently found there is a strange difference between lookup and inputlookup commands.
|makeresults | eval uid="asdf" | lookup mydata uid
|makeresults | eval uid="asdf" | join uid [| inputlookup mydata]
The "mydata" lookup is a kvstore collection, with the following columns
uid, name, address, fields
I was expecting these two queries to have the same results, but no.
It seems the column "fields" is an array and it's returning a lot of data when used with the inputlookup command , which is not the case with the first (lookup) query.
The lookup results are like this:
_key | uid | name | address | fields
... | asdf | john | yes | (empty)
The inputlookup results are like this:
_key | uid | name | address | fields.town | fields.country
... | asdf | john | yes | chicago | usa
I didn't find any documentation about this.
Your input is welcomed.
Thanks
Yes, there is a difference between lookup and inputlookup, but it's not that strange.
The lookup command searches a lookup table for the given field(s) and returns the corresponding fields for the found value. It's like getting someone's phone number from a telephone directory (remember those?) - find name, return number.
The inputlookup command returns the entire contents of the lookup file (unless the where option is used). It's the equivalent of saying "read to me the whole phone book". It has nothing to do with how the columns are named.
I hope this explains why your queries behave the way they do.
that's the definition, it's obvious they are different commands
but the results of those two commands should have been the same.
I'm still digging, it seems the "fields" it's an array
that makes me think lookup cannot deal with displaying arrays while inputlookup can show them
I think the difference in output comes from the join command, By default, it uses an inner join when perhaps you're expecting an outer join.
Try
|makeresults | eval uid="asdf" | join type=outer uid [| inputlookup mydata]
thank you,
I've edited/updated the initial question with an example