How to take output from base search and search in lookup for all rows?

[amitrinx]

Hi 
I have a lookup having two fields
| inputlookup ID-Client-Lookup.csv | fields ClientId ClientName

I have a base search
sourcetype="oxygen-standard"
| regex AllClientIDs="^[a-z0-9A-Z]{2,}$"
| stats count by AllClientIDs

I want a query which will take each ClientIDs from my base search and the search in the lookup and give me the Client Names
Can anyone help?

[richgalloway]

sourcetype="oxygen-standard"
| regex AllClientIDs="^[a-z0-9A-Z]{2,}$"
| stats count by AllClientIDs
| lookup ID-Client-Lookup.csv ClientID as AllClientIDs OUTPUT ClientName

[amitrinx]

It says error in lookup command. Cannot find the source field 'AllCliendID' in the lookup table 'ID-Client-Lookup.csv'.

[richgalloway]

Check the spelling of the field names.  The one used in the lookup command must be the same one produced by stats.  I did get the order of arguments wrong, however.  Check my modified answer.