FAQ: How do I use match() to query a lookup table?

You can use match() and select() to query a lookup table.


The specified lookup table must exist under Files. In this instance, we'll check for common ports and create a new field with their associated protocol.

| match(file="service-names-port-numbers.csv", field=LocalPort, include=ServiceName, ignoreCase=true, strict=false)
| select([@timestamp, aid, LocalPort, ServiceName, RemoteAddressIP4])