I'm trying to make a join using a lookuptable and a query from a index

With lookup table

And the SPL are don't bring the information correct
The commnad that I'm trying to use is
index=cmkprod Service_Name=PING | fields Host_Name, Service_Name, Status | join type=left Host_Name
[ inputlookup compass_ci.csv | fields Host_Name, Region, Ecosystem]
| table Host_Name, Service_Name, Status, Region, Ecosystem
How can I join the lookuptable and a index?
No need for inputlookup.. This is a leading command. You're looking for lookup like this
index=cmkprod Service_Name=PING
| fields Host_Name, Service_Name, Status
| lookup compass_ci.csv <lookup_column_name> AS <field_name> OUTPUT <column_name>
| fields Host_Name, Region, Ecosystem
| table Host_Name, Service_Name, Status, Region, Ecosystem
You will need to replace the values on line 3 to match your lookup table
No need for inputlookup.. This is a leading command. You're looking for lookup like this
index=cmkprod Service_Name=PING
| fields Host_Name, Service_Name, Status
| lookup compass_ci.csv <lookup_column_name> AS <field_name> OUTPUT <column_name>
| fields Host_Name, Region, Ecosystem
| table Host_Name, Service_Name, Status, Region, Ecosystem
You will need to replace the values on line 3 to match your lookup table
try this :
index=cmkprod Service_Name=PING
| lookup compass_cis.csv Host_Name OUTPUT Region Ecosystem
| table Host_Name, Service_Name, Status, Region, Ecosystem