I have a listed lookup table xxx .
When I run the below search. it shows no results.
inputlookup xxxx|fields USERNAME|search index=main sourcetype=oracle_aud user=*CONN*| stats count(user) by source,user
What can be the issue ?
Have check that there is no issue with the lookup table xxx |inputlookup xxxx.
Anyone can provide some good advise?
↧