How to edit my search to match a field in events to a field in a CSV lookup table, and output all corresponding results?

[athorat]

Lookuptable = C360_USERS.csv
Fields: USERID,EMPLOYEEID,AVAYAID,FIRSTNAME,LASTNAME,LOCATIONNAME,JOBCODE,JOBTITLE

I want to get all the results from the lookuptable matching userGID from the query. How do I join these two fields userGID and USERID and get all the information in a table format?

index=MRM | eval array=split(_raw,"*"), userGID=mvindex(array,9)|lookup C360_USER ......

[sundareshr]

Try this (lookup match is case sensitive)

index=MRM | eval array=split(_raw,""), userGID*=mvindex(array,9)| lookup C360_USERS.csv USERID AS userGID | where isnotnull(EMPLOYEEID) | table USERID,EMPLOYEEID,AVAYAID,FIRSTNAME,LASTNAME,LOCATIONNAME,JOBCODE,JOBTITLE

*OR*

| inputlookup C360_USERS.csv [index=MRM | eval array=split(_raw,""), userGID*=mvindex(array,9) | rename userGID AS USERID | table USERID] |table USERID,EMPLOYEEID,AVAYAID,FIRSTNAME,LASTNAME,LOCATIONNAME,JOBCODE,JOBTITLE 

[somesoni2]

Try like this

| inputlookup C360_USERS.csv | search [search index=MRM | eval array=split(_raw,""), userGID*=mvindex(array,9 | stats count by userGID | table userGID | rename userGID as USERID]