![]() ![]() You can control "which one wins" either by swapping the order or by swapping OUTPUTNEW for OUTPUT because the difference between OUTPUT and OUTPUTNEW is if the output field already exists in your event, OUTPUT will overwrite it and OUTPUTNEW won't. Solution gokadroid Motivator 10-28-2016 06:24 PM Lets say your Lookup table is 'inputLookup. You can control 'which one wins' either by swapping the order or by swapping OUTPUTNEW for OUTPUT because the difference between OUTPUT and OUTPUTNEW is if the output field already exists in your event, OUTPUT will overwrite it and OUTPUTNEW wont. The comment "whichever matches last wins" means that in the odd case where BOTH match, whichever one matches last will overwrite the existing values (from the previous match). My solution assumes that EITHER HOST OR SERVER will match. To write to a lookup you would use outputlookup. ![]() lookup using a combination of input and outputlookup but unable to modify a specific row. You can search for a specific entry in the lookup using: inputlookup file.csv search fieldnamewhatever To perform a lookup against the csv during a search would use the lookup command, like: main search lookup file.csv fieldname OUTPUT otherfieldnames. ![]() If you need "both sets" then you do not need "OR", you need "AND". lookup firewall-exception-prod.csv firewallrule as fw OUTPUT. ![]()
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |