How to append dynamic value to end of search?

[ub_ik]

Dear Community

I am looking for a way to add a static and a dynamic value at the end of a search to track the status of the (saved) search. I would like to add the dynamic value to be extraced from an CSV-File.

|...base search...
| table index, sourcetype, _time.....

| append
    [ makeresults
    | eval status="completed"
    | eval ID = missionID<field from input.csv>   
    ]

Any help is appreciated.

[ITWhisperer]

Would something like this work for you?

|...base search...
| table index, sourcetype, _time.....

| append
    [ | makeresults
    | eval status="completed"   
    ]
| append
    [ | inputlookup input.csv ]

[ub_ik]

Thx for your answer. Unfortunately not. I need the field from the lookup on the same line as

the other evals in the first append.

[ITWhisperer · Accepted solution]

|...base search...
| table index, sourcetype, _time.....

| append
    [ | inputlookup input.csv 
    | eval status="completed"]

[ub_ik]

life could be soo easy. thx a lot for your expertise.