How to compare the value of a field (search) with the value of a csv field when you have to adapt a field first

[christianubeda]

Hello team!

I would like to ask you a question since I have been thinking about it for a while and I am not getting it

I want to compare the user field of my search with the REGISTER field of my csv. The problem is that I have to adapt the user field first to be similar to REGISTER

I have tried with

search  | eval user=split(user,"\\")  |  lookup csvfile.csv REGISTRO as usern | values(user) .... | where user=usern

Can`t with inputlook cause I have to | eval user=split(user,"\\")  first

[| inputlookup csvfile.csv
| rename REGISTRO as usern
| fields usern]

user field is like aaaa111

and REGISTER is like XXX\aaaa111

Thank you!

[rupkumar4sec]

@christianubeda 
If your user field is like “aaaa111” and REGISTER is like “XXX\aaaa111”, why are you splitting user field? If what I understood is correct, your eval should be on the lookup field(Register). 

[inventsekar]

Hi @christianubeda ... i am not much clear of your issue.. 

but i can try to edit this query...

search  | eval user=split(user,"\\")  |  lookup csvfile.csv REGISTRO as usern | values(user) .... | where user=usern 

should be / could be ....

base-search  | eval user=split(user,"\\")  | join [lookup csvfile.csv REGISTRO as usern] | stats values(user) AS UserNames .... | where user=usern