Join with different field names

[jenkinsta]

I have an inputlookup called adexport.csv thats big...

trying to join and match two fields in the lookup UserName and with the splunk field UserId.

trying but this don't seem to work. Tried a variation of join and append, my splunk foo is dead

index=data
| lookup adexport.csv UserName as UserId OUTPUT UserId Title
| table _time UserId Title

[jenkinsta · Accepted solution]

Got it. actually renamed the field in csv and re-uploaded...

join UserId [inputlookup adexport.csv | fields UserId Title ]

why did I complicate things. 

If there is a faster way let me know

[gcusello]

Hi @jenkinsta ,

your solution surely work, but you could also try:

index=data
| lookup adexport.csv UserName AS UserId OUTPUT Title
| table _time UserId Title

Ciao.

Giuseppe