| inputlookup clusName.csv | fields cluster ----works in a dropdown and has around 10 entries
Now, I need to use the values in the cluster field to display rest of the information.
index = * sourcetype=***** eventtype=* | stats values(eventtype) as Eventtype values(source) as Source values(host) as Host by values[|inputlookup clusName.csv | fields cluster]
I get till Host details fine. But it doesn't work on the output of input lookup field. Is this possible to achieve?
↧