You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/search/lookup-tables/create-lookup-table.md
+19-17Lines changed: 19 additions & 17 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -54,7 +54,7 @@ When you create a Lookup Table schema, note the following requirements:
54
54
55
55
Currently, the ability to reference a field in a new style Lookup Table in a [Search Template](/docs/search/get-started-with-search/build-search/search-templates) is not supported. However, you can refer to [classic Lookup Tables](/docs/search/search-query-language/search-operators/lookup-classic) in Search Templates.
56
56
57
-
## How many Lookup Tables can you have?
57
+
###How many Lookup Tables can you have?
58
58
59
59
The number of Lookup Tables you can have depends on what type of Sumo Logic account you have, as shown in the table below.
60
60
@@ -67,7 +67,7 @@ The number of Lookup Tables you can have depends on what type of Sumo Logic acco
***Lookup Name**. Enter a name for the Lookup Table.
91
91
***Description** (Optional). Enter a description of the Lookup Table.
92
92
***Do you want a TTL for table entries?** A TTL specifies a time limit beyond which an unchanged row in the table will be unavailable for reads and will be deleted. For example, if you set a TTL of 5 minutes for a lookup table, when 5 minutes pass without a row being updated, that row will no longer be returned by lookups and will be deleted from the lookups table. A TTL is useful for managing the freshness of the data and the size of the table.
@@ -96,7 +96,7 @@ schema without populating the table.
96
96
***Stop Incoming Data**. Once the Lookup Table size limit is reached, no new data will be added to the table.
97
97
***Delete Old Data**. The rows that have been modified or updated least recently will be replaced by new rows.
98
98
***How do you want to create lookup?** Click **Create Schema only**.
99
-
1. The page displays a **Schema** section. <br/>
99
+
1. The page displays a **Schema** section. <br/><img src={useBaseUrl('img/search/lookup-tables/schema.png')} alt="Schema" style={{border: '1px solid gray'}} width="800" />
100
100
1.**Schema**. For the first column in the table, enter:
101
101
***Field**. Enter a name for the field. As you name your fields, note reserved keywords listed in [Reserved keywords](create-lookup-table.md).
102
102
***Value Type**. Choose the value type: boolean, int, long, double, or string (default).
@@ -120,45 +120,47 @@ No spaces are allowed between quotes and values for field names. For example, `"
120
120
As you name your fields, note the information in [Reserved keywords](#reserved-keywords).
121
121
122
122
1. Go to your **Library**.
123
-
1. Click **Add New** and then select **New Lookup**.<br/>
123
+
1. Click **Add New** and then select **New Lookup**.<br/><img src={useBaseUrl('img/search/lookup-tables/new-lookup-button.png')} alt="New lookup button" style={{border: '1px solid gray'}} width="800" />
124
124
1. Enter the following on the **Create Lookup Table** page:
125
125
***Lookup Name**. Enter a name for the Lookup Table.
126
126
***Description** (Optional). Enter a description of the Lookup Table.
127
127
***Do you want a TTL for table entries?** A TTL specifies a time limit beyond which an unchanged row in the table will be unavailable for reads and will be deleted. For example, if you set a TTL of 5 minutes for a lookup table, when 5 minutes pass without a row being updated, that row will no longer be returned by lookups and will be deleted from the lookups table. A TTL is useful for managing the freshness of the data and the size of the table.
128
128
* Click **Yes** if you want to set a TTL.
129
129
* Enter an integer value in the **Duration** field, and select a unit of time from the pulldown: **Seconds**, **Minutes** (default), **Hours**, or **Days**.
130
130
***How do you want to create lookup?** Click **Upload File**.
131
-
1. The **Upload File** section appears.<br/>
***Advanced Upload Settings** (Optional). If your .csv file is encoded in a format other than UTF-8, select the format from the pull-down.
133
133
1. Click **Upload**.
134
134
1. Navigate to the file you want to upload and click **Open**.
135
-
1. The **Schema** section of the page refreshes, and displays up to 10 rows from the .csv file you uploaded.<br/>
135
+
1. The **Schema** section of the page refreshes, and displays up to 10 rows from the .csv file you uploaded.<br/><img src={useBaseUrl('img/search/lookup-tables/create-by-upload.png')} alt="Create by upload" style={{border: '1px solid gray'}} width="800" />
136
136
1. For each column in the table:
137
137
***Value Type**. Choose the value type: boolean, int, long, double, or string (default).
138
138
***Primary Key**. Click the **Yes** checkbox if the field is part of the primary key for the table. Defining a primary key for your Lookup Table is required.
139
139
1. Click **Create** in the upper right of the page.
140
140
141
-
### View the contents of a Lookup Table
141
+
## View Lookup Tables content
142
+
143
+
### View the contents of a single Lookup Table
142
144
143
145
1. Go to your **Library**.
144
-
1. Click in the search bar, and select **Lookups** from the dropdown. <br/>
146
+
1. Click in the search bar, and select **Lookup Tables** from the dropdown. <br/><img src={useBaseUrl('img/search/lookup-tables/search-for-lookups.png')} alt="Search for lookups" style={{border: '1px solid gray'}} width="200" />
145
147
1. Hover over the Lookup Table you want to view, and select **Open** from the three-dot kebab menu.
146
-
1. The view page for the Lookup Table appears. It displays a preview of the contents of the Lookup Table, up to 10 rows. <br/>
148
+
1. The view page for the Lookup Table appears. It displays a preview of the contents of the Lookup Table, up to 10 rows. <br/><img src={useBaseUrl('img/search/lookup-tables/lookup-created.png')} alt="Lookup created" style={{border: '1px solid gray'}} width="800" />
147
149
1. To view the complete contents of the Lookup Table, click **View Data**.
148
-
1. A Sumo Logic search tab opens and a `cat` command is run on your table. <br/>
150
+
1. A Sumo Logic search tab opens and a `cat` command is run on your table. <br/><img src={useBaseUrl('img/search/lookup-tables/view-lookup-table.png')} alt="View lookup table" style={{border: '1px solid gray'}} width="800" />
149
151
150
-
## Find a lookup table path
152
+
###Find a lookup table path
151
153
152
154
When you run search operators that work with Lookup Tables (described in the following section), you need to know the path to the Lookup Table in the Sumo Logic Library. The path can be determined in a couple of ways:
153
155
154
-
* From the **Actions** menu on the Lookup Table page. <br/>
155
-
* From the three-dot kebab menu for a Lookup Table in the Sumo Logic Library. <br/>
156
+
* From the **Actions** menu on the Lookup Table page. <br/><img src={useBaseUrl('img/search/lookup-tables/copy-path-actions-menu.png')} alt="Copy path actions menu" style={{border: '1px solid gray'}} width="800" />
157
+
* From the three-dot kebab menu for a Lookup Table in the Sumo Logic Library. <br/><img src={useBaseUrl('img/search/lookup-tables/copy-path-lib.png')} alt="Copy path library menu" style={{border: '1px solid gray'}} width="800" />
156
158
157
-
##Operators you use with Lookup Tables
159
+
### Find Lookup Tables content with search operators
158
160
159
161
You can use the following operators with Lookup Tables in Sumo Logic log searches and in Cloud SIEM rules:
160
162
161
163
*`cat`. You can view the contents of a Lookup Table using the `cat` operator in a Sumo Logic log search tab. For more information, see [cat](/docs/search/search-query-language/search-operators/cat).
162
164
*`lookup`. You can use the `lookup` operator to return one or more fields from a Lookup Table. For more information, see [lookup](/docs/search/search-query-language/search-operators/lookup).
163
165
*`lookupContains`. You can use the `lookupContains` operator to see whether a key exists in a Lookup Table. For more information, see [lookupContains](/docs/search/search-query-language/search-operators/lookupcontains).
164
-
*`save`. You can use the `save` operator to save the results of a Sumo log query to a Lookup Table you created using the Lookup UI or API. For more information, see [save](/docs/search/search-query-language/search-operators/save).
166
+
*`save`. You can use the `save` operator to save the results of a Sumo log query to a Lookup Table you created using the Lookup UI or API. For more information, see [save](/docs/search/search-query-language/search-operators/save).
Copy file name to clipboardExpand all lines: docs/search/search-query-language/search-operators/lookup.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ sidebar_label: lookup
6
6
7
7
The `lookup` operator can return one or more fields from a lookup table hosted by Sumo Logic and add the fields to the log messages returned by your query. You create a lookup table using the lookup UI or the [Lookup API](/docs/api/lookup-tables). You can populate a lookup table by uploading a CSV file using the Lookup API, or by using the [`save` operator](/docs/search/search-query-language/search-operators/save) to save the results of a log query.
8
8
9
-
For information about lookup tables, see [Create and Manage Lookup Tables](/docs/search/lookup-tables/create-lookup-table.md).
9
+
For information about lookup tables, see [Lookup Tables](/docs/search/lookup-tables/).
0 commit comments