Specify Fields for Outputlookup or Outputcsv

[mattcg]

How can I get outputlookup or outputcsv to only include certain fields in the resulting lookup file?

An example explains it better:

SEARCH | DEDUP FieldName1 | FIELDS FieldName1, FieldName2 | OUTPUTLOOKUP lookupFile.csv

I want the resulting lookup file to be formatted with just an entry of "FieldValue1, FieldValue2" per line per result. I do not want the full raw logs in the lookup as it seems to be doing.

[ziegfried · Accepted solution]

<search> | dedup FieldName1 | table FieldName1 FieldName2 | outputlookup mylookup

[nick405060]

I downvoted this post because this isn't an elegant solution. I don't want to table my fields before I output because there are other fields that I don't want to output but that I want to keep to do other processing with.

[n0vsec]

Did you ever find an answer to this?  I wanting to do a similar search.  I only want to append specific fields to a lookup table, while keeping the rest of the fields for alert automation.