I have a lookup with 4 fields per record. I want to update one of the fields, a timestamp with the last seen event time per host. How do I have the search query find the results and update just the timestamp field in the lookup table?
CLM_pair Firewall_name Logging_Device Last_Seen
Here is what I am trying but doesn't work.
| inputlookup CheckpointFW.csv
[ search index=ckpfw002 sourcetype=opsec
| rex "CN=(?P\S+),"
| fields _time FW
| stats values(FW) as "Firewall_Name" latest(_time) as "Last_Seen" by FW
| convert ctime("Last_Seen") ]
| stats count by Firewall_Name Last_Seen
| outputlookup append=true CheckpointFW.csv