Deprecated: 1.30
This function is deprecated. Refer to match()
function instead.
Enhances events with metadata. Data can be managed in the Files tab in the UI or be uploaded as CSV or JSON files using the files endpoint.
| Parameter | Type | Required | Default Value | Description |
|---|---|---|---|---|
from[a] | string | required | Specifies the source file. | |
include | array of strings | optional[b] | all | Specifies fields to include, defaults to all. |
on | array of strings | required | Specifies which field(s) to join on; if passed as array the first is the field from the file, the second is from the event. | |
[b] Optional parameters use their default value unless explicitly set. | ||||
Hide omitted argument names for this function
Omitted Argument NamesThe argument name for
fromcan be omitted; the following forms of this function are equivalent:logscale Syntaxlookup("value",on=["value"])and:
logscale Syntaxlookup(from="value",on=["value"])These examples show basic structure only.
lookup() Examples
Lookup rows from table users.csv
where the userid column equals
the id field of this event
logscale
lookup("users.csv", on=[userid,id])