Update a Lookup Table with Identity information coming from our index "elist"

[MikeVenable]

I need to update a Lookup Table with Identity information coming from our index "elist", I am trying get the search to take the events from the elist and compare it to the current lookup table, If the identity already exists in the lookup table then it will not add anything, but if doesn't it will add it. But also I would like it to check the end Date and if not null it will add the new information. This is what I have so far. the eList and the Lookup have different fields so I have to rename everything to match. Thanks!

index="elist" | search LoginID="MV123456" | rename LoginID AS identity, NickName AS nick, FirstName AS first, LastName AS last, Email AS email, SupName AS managedBy, DeptName AS bunit, JobTitle AS category, HireDate AS startDate, TermDate AS endDate, ST AS work_location, Phone AS phone| table identity, prefix, nick, first, last, suffix, email, phone, managedBy, priority, bunit, category, watchlist, startDate, endDate, work_location, work_country | outputlookup simple_identity_lookup append=t

[jawaharas · Accepted solution]

Try below SPL.

index="elist" 
| search LoginID="MV123456" 
| rename LoginID AS identity, NickName AS nick, FirstName AS first, LastName AS last, Email AS email, SupName AS managedBy, DeptName AS bunit, JobTitle AS category, HireDate AS startDate, TermDate AS endDate, ST AS work_location, Phone AS phone 
| table identity, prefix, nick, first, last, suffix, email, phone, managedBy, priority, bunit, category, watchlist, startDate, endDate, work_location, work_country 
| search NOT 
    [| inputlookup simple_identity_lookup 
    | table identity]
| outputlookup simple_identity_lookup append=t

[jawaharas]

@MikeVenable
Can you accept the answer if it's helped you? Thanks.