How to read data from lookup file?

[sbimizry]

Hi, how to read data from the lookup file (.csv) using command lookup?
Lookup example:
FIELDS
field1
field2
field3
I try it: lookup file.csv FIELDS OUTPUT FIELDS AS newfield | table newfield but this not work, how I must write this search?
Thanks

[woodcock · Accepted solution]

The lookup command does not read data from a file, it correlates data. You have to have a field in your event whose values match the values of a field inside the lookup file. To truly read data from a lookup file, you use inputlookup like this:

| inputlookup <Your Lookup File Here>

[starcher]

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/inputlookup?splunkbot