How to edit my search to join results with a lookup table?

[chadman]

I have a lookup table and have one search working good. I have another search I want to join to the lookup table, but can't figure out the syntax.

This works just how I need it to:

| inputlookup Meeting_Rooms 
| join type=left host [metadata type=hosts] 
| eval age = now()-lastTime | where age > 900 
| convert ctime(lastTime) | eval field_in_ddhhmmss=tostring((age) , "duration") 
| rename field_in_ddhhmmss as "Time Offline" lastTime as "Last Update Time" host as "Serial Number"
| sort + "lastTime" 
| table "Serial Number" "Time Offline" "Last Update Time" Campus Building Room

This works, but I would like to add Campus Building Room to the table at the end of it, but not sure how. If I just add those to the table they come up blank.

sourcetype="sortlog"  earliest=-30m [| inputlookup Meeting_Rooms | fields host]  
| stats avg(cpu) as "CPU Percent" by host | where 'CPU Percent' > 80 | rename host as "Serial Number" 
| eval "CPU Percent" = round('CPU Percent',0) 
| table "Serial Number" "CPU Percent"

[sundareshr · Accepted solution]

Try this (assuming Campus Building Room is in the lookup file)

sourcetype="sortlog" earliest=-30m [| inputlookup Meeting_Rooms | fields host] 
| stats avg(cpu) as "CPU Percent" by host | where 'CPU Percent' > 80 
| lookup Meeting_Rooms host OUTPUT "Campus Building Room" 
| rename host as "Serial Number" 
| eval "CPU Percent" = round('CPU Percent',0) 
| table "Serial Number" "CPU Percent" "Campus Building Room"

[chadman]

perfect! Campus Building and Room are all separate fields, but removed the quotes and works great. Thanks so much!