A filename references a lookup file that has been uploaded to LogScale's file management system. These files typically contain reference data such as mappings, lists, or enrichment information that can be joined with query results or used for data validation.

The filename must be specified as a quoted string and should match exactly the name of the file as it appears in the lookup files system, including the file extension. Common file formats include CSV files for tabular data and text files for lists.

For example, "host_names.csv" might contain a mapping of IP addresses to hostnames, or "threat_indicators.txt" might contain a list of known malicious domains for security enrichment.

match(file="host_names.csv", field=ip_addr, column=hostname)

match(file="known_malicious_ips.txt", field=src_ip)

match(file="user_departments.csv", field=username, include=[department, manager])

Functions using this Type: cidr(), dropEvent(), eval(), fieldset(), matchAsArray()