Appending a static lookup

[ivan128]

Hi all,

I'm looking for a way to append the contents of a CSV table to any search I make as an additional column. For example I have the following search:

index=X  sourcetype=Y name=Z | dedup host-ip, plugin_name, plugin_family, severity, "ports{}.port", "ports{}.protocol" | chart count by host-ip

This gives me a table like this:

host-ip           count
1.1.1.1            3
2.2.2.2            4
3.3.3.3            7

I though that adding |inputlookup append=t testing.csv at the end of the search would add an additional column with the results from the lookup table but instead it adds them under the results from the search.

The contents of the CSV files are a list of IP addresses and I want a result that looks something like this:

host-ip           count    csvIP
1.1.1.1            3           1.1.1.1
2.2.2.2            4           2.2.2.2
3.3.3.3            7           3.3.3.3

Is there a command or parameter in the lookup command that can help me with this case?

Edit: Edited for clarity.

[somesoni2]

The append command, as the name suggest, appends the result at the bottom of current result. Not sure what is your exact requirement, but you may want to use appendcols command. Would you mind showing what your final output should look like?

[ivan128]

I edited the question for clarity. I looked up the appendcol command and it seems that it works with subsearches, so I'm not entirely sure how it would work with an inputlookup, I tried using:

index=X sourcetype=Y name=Z | dedup host-ip, plugin_name, plugin_family, severity, "ports{}.port", "ports{}.protocol" | chart count by host-ip| appendcols [inputlookup testing.csv]but it didn't work, it only presented me the original results, possibly I wrote something incorrecctly.