If i have 3 column in lookup table like column "A" is dedicated for IP column "B" is dedicated for hash and column "C" is dedicated to URL. how can i match fields(IP,Hash,URL) of lookup table with the fields in index=main
index=main "other search terms"|fields IP,HASH,URL "other fields" | lookup "yourlookupfile/table" A as IP,B as HASH, C as URL
Refer : https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Lookup