search query help for using lookup

[AKG1_old1]

Hello,

I am looking to use a lookup in my search query. basically  in lookup, I have 2 rows for threshold  and I wanted to use them in my search query as 2 column.
Screenshot of csv and search query  requirement.


Lookup

Lookup Edit _ Splunk 8.1.0.png

expected search query results

Search _ Splunk 8.1.0.png

I tried like this. but not sure if there is better way to implement this requirement.

| appendcols
[| inputlookup test.csv
| table MetricName Threshold
| where MetricName="threads"
| rename Threshold as nbThreadsThreshold
]
| appendcols
[| inputlookup test.csv
| table MetricName Threshold
| where MetricName="openFiles"
| rename Threshold as nbOpenFilesThreshold
]
| filldown nbThreadsThreshold nbOpenFilesThreshold

Thanks

[kamlesh_vaghela · Accepted solution]

@AKG1_old1 

Can you please try this?

| appendcols [
| inputlookup test.csv | table MetricName Threshold | where MetricName IN ("threads","openFiles")
| transpose header_field=MetricName | table threads openFiles]
| filldown threads openFiles

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.