Using Lookup csv file to query fieldname

[chrismatt02]

I have a lookup file saved with a single column having values of specific fields in it. And want to use to search in query which matched with values in field names

Example:

lookupname : test.csv
column name: column1

fieldname: field1

[yuanliu · Accepted solution]

See syntax help in lookup.  This is what I suggest:

| lookup column1 AS field1 test.csv output column1 as match
| where isnotnull(match)

[ITWhisperer]

This is a bit vague. Can you give an example of the type of search you are trying / wanting to do with your lookup?

[chrismatt02]

@ITWhisperer I am using lookup file with single column, multiple entries which contains filenames. I am trying to match that names with the Filename field in query to obtain results which matches the value.

[PickleRick]

OK. But do you have just one column with multiple values? Or do you have multiple columns? How would your lookup contents match the data you want to search for?

[chrismatt02]

@PickleRick I am using single column multiple entries and just trying to compare values in lookup file with the logs which contains those values and output the results

[PickleRick]

With a relatively dense search the approach shown by @yuanliu is the most typical thing to do.

But if you expect that the search will be sparse, you might want to use the lookup by means of a subsearch to generate a set of conditions directly into your search

<your_base_search> [ | inputlookup your_lookup.csv | rename if needed ]
| <rest_of_your_search>

This might prove to be more effective if your resulting set of conditions is small and yields only a handful of events.