Pulling multiple Columns from an inputlookup

[dbturner]

Trying to pull more than one column from an inputlookup. One of the columns maps to a field in the index I am searching in and the other I just want in as a category to table with. Struggling with how I would do that.

This is my current search and added subsearch:
index=myindex [| inputlookup my.csv | fields ip | rename ip as asset_ip] - I want to bring in a column named system from the lookup but don't need to rename it to fit into the index. I just want to make sure the system id in the lookup matches up to the appropriate ip for charting/tabling.

[richgalloway · Accepted solution]

I think you may need to use the lookup twice.

index=myindex [| inputlookup my.csv | fields ip | rename ip as asset_ip] | lookup my.csv ip as asset_ip output system