This message originated from Cribl Community Slack.
Click here to view the original link.
Any general recommendations on using C.Lookup in an EVAL, versus using the Lookup function? I've always just used the C.Lookup in the eval, but I'm curious if / what are the benefits of using one over the other
Solved
C.Lookup Versus Lookup Function Recommendations In EVAL Usage
Best answer by Jon Rust
C.Lookup accepts only a single lookup key, whereas Lookup can have multiple.
You can specify reload period in the Lookup function
C.Lookup references in memory lookups only I believe
Lookup function can specify which type of match (first, most specific, all) when using a pattern-based match
C.Lookup accepts only a single lookup key, whereas Lookup can have multiple.
You can specify reload period in the Lookup function
C.Lookup references in memory lookups only I believe
Lookup function can specify which type of match (first, most specific, all) when using a pattern-based match
Sign up
Already have an account? Login
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.