I am trying to create a query that combines results from 3 sources, one of which is a lookup table. Any help would be appreciated.
(sourcetype="sourcetypeA OR sourcetype="sourcetypeB" ) fieldinsourcetypeAndB=*
| fields [all fields in A and B]
|stats values(*) as * by fieldinsourcetypeAndB
|appendcols [| inputlookup sourcetypeC.csv | fields fieldinA fieldinC]
↧