I have the below two csv files:
1. ProductSales.csv
2. RegionalSales.csv
ProductSales.csv
**************
ProductId,Product_name,Price
DB-SG-G01,Mediocre Kingdoms,24.99
DC-SG-G02,Dream Crusher,39.99
FS-SG-G03,Final Sequel,24.99
WC-SH-G04,World of Cheese,24.99
WC-SH-T0,World of Cheese Tee,9.99
PZ-SG-G05,Puppies vs. Zombies,4.99
CU-PG-G06,Curling 2014,19.99
MB-AG-G07,Manganiello Bros.,39.99
MB-AG-T0,Manganiello Bros. Tee,9.99
FI-AG-G08,Orvil the Wolverine,39.99
BS-AG-G09,Benign Space Debris,24.99
SC-MG-G10,SIM Cubicle,19.99
WC-SH-A01,Holy Blade of Gouda,5.99
WC-SH-A02,Fire Resistance Suit of Provolone,3.99
RegionalSales.csv
***************
ProductId,TimeStamp,Region,Quantity
DC-SG-G01,9/6/2017,GA,5
DC-SG-G01,9/5/2017,GA,3
DC-SG-G01,9/4/2017,GA,6
DC-SG-G01,9/3/2017,GA,2
DC-SG-G01,9/6/2017,GA,1
DC-SG-G01,9/6/2017,TX,4
DC-SG-G01,9/5/2017,TX,5
DC-SG-G01,9/3/2017,TX,6
DC-SG-G01,9/2/2017,TX,1
DC-SG-G01,9/2/2017,TX,2
DC-SG-G02,9/3/2017,GA,4
DC-SG-G02,9/4/2017,GA,3
DC-SG-G02,9/3/2017,GA,5
DC-SG-G02,9/3/2017,GA,7
DC-SG-G02,9/1/2017,GA,9
DC-SG-G02,9/3/2017,TX,2
DC-SG-G02,9/4/2017,TX,5
DC-SG-G02,9/3/2017,TX,7
DC-SG-G02,9/3/2017,TX,2
DC-SG-G02,9/1/2017,TX,1
Added **RegionalSales.csv** file using **"Add Data" -> "Monitor" -> "Files&Directory"** options and Created a lookup table and configure the automatic lookup for the **ProductSales.csv** file.
Now doing search for the latest regional sales using below query:
sourcetype="reg_sales_csv" | dedup ProductId, Region| stats latest(TimeStamp) as TimeStamp by ProductId, Region, Quantity| xyseries ProductId Region Quantity| table ProductId , TimeStamp , GA, TX | fillnull Quantity=NA
So the search output something like below:
![alt text][1]
But not able to take the fields from the lookup table(SalesDetails.csv).
Actually expecting the below kind of table.
![alt text][2]
Need to display **ProductName, Price** fields for each productId from the lookup table.
How to join these search result with the lookup table matching records and framing this kind of table?
[1]: /storage/temp/209760-searchresult.png
[2]: /storage/temp/209762-expected.png
↧