Trying to pull more than one column from an inputlookup. One of the columns maps to a field in the index I am searching in and the other I just want in as a category to table with. Struggling with how I would do that.
This is my current search and added subsearch:
index=myindex [| inputlookup my.csv | fields ip | rename ip as asset_ip] - I want to bring in a column named system from the lookup but don't need to rename it to fit into the index. I just want to make sure the system id in the lookup matches up to the appropriate ip for charting/tabling.
