Append multiple field values to a csv list

[josplunk]

Hi folks,

I'm trying to append multiple field values to a csv as a result of a search. The csv file contains a list of seen hashes. 

I have the following query:

index=AV NOT([ | inputlookup Hashes.csv | stats values(hashes) AS search| format ])

So, the question here is, how can I add the resulting hash values from the previous search into the CSV?

I already try with the following qery with no results:

| foreach * [|append [makeresults | eval hashes=file_hash] | fields hashes | outputlookup Hashes.csv]

[ITWhisperer · Accepted solution]

Try something like this

index=AV NOT([ | inputlookup Hashes.csv | stats values(hashes) AS search| format ])
| table hashes
| outputlookup append=t Hashes.csv