Module 12: Lookups Flashcards
1
Q
Lookup
A
Outside non-event data added to an index to provide supporting info/context
(Dataset)
2
Q
Two steps to setup a lookup
A
Upload lookup file (CSV)
Define lookup type
3
Q
Lookup command
A
inputlookup
4
Q
Lookups are assigned to which apps?
A
Only the one imported to or with permissions.
5
Q
Output clause
A
Choose which fields lookup returns
(New fields)
6
Q
outputnew clause
A
Prevents overwriting existing fields
7
Q
inputlookup command
A
Load results from static lookup
Works on file and imported definition {values}
8
Q
Time-based lookups
A
Can be created if a field contains a timestamp
