Different lookup csv depending on field value

[chrkohm]

Hi,
I´m trying to lookup different csv-files depending on an field-Value.
But it seems to be a problem for the lookup command to handle an variable as lookup-csv-file.

index=yxz
| search model="123"
| eval lookupfile=case(model == 123, "123_lookup.csv", model == 456, "456_lookup.csv", model == 789, "789_lookup.csv")
| lookup lookupfile ErrorCode

I´m getting this Error Message:

Error in 'lookup' command: Could not construct lookup 'lookupfile, ErrorCode'. See search.log for more details.

Can someone help me with this?

[jkat54]

The only way I ever got this "case for dynamic lookups" to work was by using a dashboard and setting a token with the eval in a drop down, and then I used the token in my search in my dashboard panel.

[richgalloway]

I'm pretty sure lookup won't take a field name, but try this before giving up.

| lookup 'lookupfile' ErrorCode