How to update a timestamp field in a lookup csv that has many fields, but when you only want to update one field?

[john_glasscock]

I have a lookup with 4 fields per record. I want to update one of the fields, a timestamp with the last seen event time per host. How do I have the search query find the results and update just the timestamp field in the lookup table?

I.E Lookup.csv
CLM_pair Firewall_name Logging_Device Last_Seen

Here is what I am trying but doesn't work.

| inputlookup CheckpointFW.csv
| append
[ search index=ckpfw002 sourcetype=opsec
| rex "CN=(?P\S+),"
| fields _time FW
| stats values(FW) as "Firewall_Name" latest(_time) as "Last_Seen" by FW
| convert ctime("Last_Seen") ]
| stats count by Firewall_Name Last_Seen
| outputlookup append=true CheckpointFW.csv