"Cannot lookup on event_code. The field event_code doesn't exist in the lookup file."

Follow

Mark Drummond

• December 21, 2018 16:33

I have a CSV here. When I try to run a lookup against it, I get:

Cannot lookup on event_code. The field event_code doesn't exist in the lookup file.

My query:

_sourceCategory=auth0/prod
| json field=_raw "type" as auth0_log_event_code
| lookup event_description from https://github.com/dmark/auth0-cli-utilities/blob/master/auth0_log_event_table.csv on event_code=auth0_log_event_code

I believe the CSV is formatted to Sumo's specifications:

"event_code","event_type","event_description","additional_info"
"admin_update_launch","Auth0 Update Launched","",""
"api_limit","Rate Limit On API","The maximum number of requests to the API in given time has reached.","Rate Limit Policy"

0

• Official comment

  

  Raghu Murthy

  • December 21, 2018 22:21

  Nice work, Mark :+1:

  Permalink
• 

  Mark Drummond

  • December 21, 2018 16:40

  The lookup line is actually:

  | lookup event_description from
  https://github.com/dmark/auth0-cli-utilities/blob/master/auth0_log_event_table.csv
  on auth0_log_event_code=event_code

  I had the "on" part backwards, but still get the same error.

  0

  Permalink
• 

  Mark Drummond

  • December 21, 2018 16:41

  Fixed: I was not using the "raw" Github link:

  _sourceCategory=auth0/prod
  | json field=_raw "type" as auth0_log_event_code
  | lookup event_description from https://raw.githubusercontent.com/dmark/auth0-cli-utilities/master/auth0_log_event_table.csv on auth0_log_event_code=event_code

  0

  Permalink

Please sign in to leave a comment.