@christianubeda If your user field is like “aaaa111” and REGISTER is like “XXX\aaaa111”, why are you splitting user field? If what I understood is correct, your eval should be on the lookup field(Register).
search | eval user=split(user,"\\") | lookup csvfile.csv REGISTRO as usern | values(user) .... | where user=usern
should be / could be ....
base-search | eval user=split(user,"\\") | join [lookup csvfile.csv REGISTRO as usern] | stats values(user) AS UserNames .... | where user=usern