How to populate multiple fields from lookup csv into search results

[tkiermaier_shel]

Hi,
I am needing to pull multiple fields from a lookup CSV into the results from a proxy search

Primary search is:

index=PROXY domain=example.com
| transaction user maxspan=1m
| stats count by user

This gives me
user - count
SURNAME, FIRSTNAME - X(count)

Next I have a lookup CSV containing an AD dump that I want to enrich the first search, *note the Nickname field follows the same format as the user field from the proxy results

| fields user, Branch, Group, count
| lookup AD_all_users.csv Nickname as user, Dep_Branch as Branch, Dep_Group as Group

however when I run these searches together we get

index=PROXY domain=example.com
| transaction user maxspan=1m
| stats count by user
| fields user, Branch, Group, count
| lookup AD_all_users.csv Nickname as user, Dep_Branch as Branch, Dep_Group as Group

User - Branch - Group - count
SURNAME,FIRSTNAME - NULL - NULL - X(count)

anyone able to advise me of wat I have wrong?

PS the lookup CSV has about 30 columns and I only need the 3

[richgalloway]

As it often happens, the stats command is the culprit. stats returns only those fields used in the command, which in this example is only 'count' and 'user', so there is no 'Branch' or 'Group' field for later commands to use.

Try stats count, values(*) as * by user or eventstats count by user (which does not have the same side-effect as stats).

[tkiermaier_shel]

@richgalloway 

so now that I have had a chance to get back to this issue I am not sure what I am doing wrong.

I have tried using eventstats and the values arguments but I still have had no success

[richgalloway]

Run your query one statement (pipe) at a time, making sure you get the expected results before adding the next statement. You should soon see which statement is causing the problem.