"Cannot lookup on event_code. The field event_code doesn't exist in the lookup file."
I have a CSV here. When I try to run a lookup against it, I get:
Cannot lookup on event_code. The field event_code doesn't exist in the lookup file.
My query:
_sourceCategory=auth0/prod
| json field=_raw "type" as auth0_log_event_code
| lookup event_description from https://github.com/dmark/auth0-cli-utilities/blob/master/auth0_log_event_table.csv on event_code=auth0_log_event_code
I believe the CSV is formatted to Sumo's specifications:
"event_code","event_type","event_description","additional_info" "admin_update_launch","Auth0 Update Launched","","" "api_limit","Rate Limit On API","The maximum number of requests to the API in given time has reached.","Rate Limit Policy"
-
Official comment
Nice work, Mark :+1:
Comment actions
Please sign in to leave a comment.
Comments
3 comments