How can I enrich my search results with an inputlookup?

[renems]

I'm having a really hard time figuring this one out. How can I enrich my search results with an inputlookup?

In this search I can show all hosts that do have a filesystem for a specific process, but don't have that process running:

index=ix_*_nix_p host=*.linux.domain.com sourcetype=df Filesystem="/dev/mapper/vg.appl-lv.was70" OR Filesystem="/dev/mapper/vg.appl-lv.was70" NOT [ search index=ix_*_nix_p host=*.linux.domain.com sourcetype=ps COMMAND=java USER=ups | dedup host | fields host ] | dedup host | table host

I also created an outputlookup (cpu.csv), showing 3 fields: host, cpu-count, and cpu-type.

Now, I would really like to enrich the first search, with the specs from the cpu's, resulting in host (from first search), cpu-count and cpu-type (from inputlookup).

Thank you in advance!

[somesoni2]

Try this

 index=ix_*_nix_p host=*.linux.domain.com sourcetype=df Filesystem="/dev/mapper/vg.appl-lv.was70" OR Filesystem="/dev/mapper/vg.appl-lv.was70" NOT [ search index=ix_*_nix_p host=*.linux.domain.com sourcetype=ps COMMAND=java USER=ups | dedup host | fields host ] | dedup host | table host | lookup cpu.csv host

Assuming cpu.csv is set as lookup table and its scope/permissions have been setup correctly to be accessible here.