I need to add multiple values from a CSV to a main Search I have, I used the lookup command but I think that will just compare one field from the main search and the CSV and I need to add more fields from the CSV to do some evals, Please help!
can you please show me how to put it in splunk currently I have this:
| lookup Hirings.csv Last_Name AS Last
I need to add more fields from the CSV one of this fields is called "Search_Status" but I don't know how to set the syntax for this.
By default, the lookup command will return all fields from the lookup file that were not used as inputs. If you want a selection of fields or want to make it clearer which fields are being obtained, then use the OUTPUT or OUTPUTNEW option. The latter returns only the fields that don't already exist.
The lookup command can compare multiple fields and return multiple fields so it may work for you. Please tell us more about your use case.