inputlookup
Description
Returns data from a lookup.
Syntax
... | inputlookup <lookup-name> [append=<bool>] [max=<int>] [start=<int>]
Required Arguments
| Parameter | Syntax | Description |
|---|---|---|
lookup-name | <lookup-name> | Name of the predefined lookup. |
Optional Arguments
| Parameter | Syntax | Default | Description |
|---|---|---|---|
append | append=<bool> | false | true appends to existing data, false ignores existing data. |
max | max=<int> | Integer.MAX (2147483647) | Maximum number of events to search. |
start | start=<int> | 0 | Offset for the first event to read, 0 for the first event. |
system | system=<bool> | false | When set to true, a system lookup is requested; otherwise, a user lookup. |
Example Queries
Example №1
| inputlookup my_lookup system=true
Example №2
| inputlookup my_lookup max=2