help to write the request correctly

[gitingua]

Hello guys!!

help to write the request correctly. otherwise I don't understand how to do it right

file.csv

username	ip_address_old	id_old	desti
John	192.168.11.5	1234	abcd

index = IndexName

usernem	ip_address_new	id_new	desti
John	172.168.15.10	4321	bsir

Where id_old != id_new. output

usernem	ip_address_new	id_new	desti	id_old
John	172.168.15.10	4321	bsir	1234

[somesoni2]

Try something like this:

index=IndexName 
| table username ip_address_new id_new desti
| lookup username file.csv OUTPUT id_old
| where id_new!=id_old

[gitingua · Accepted solution]

index=IndexName 
| table username ip_address_new id_new desti
| lookup file.csv username OUTPUT id_old
| where id_new!=id_old

Thanks !!

[gitingua]

Error in 'lookup' command: Could not construct lookup 'username, file.csv, OUTPUT, id_old'.

[somesoni2]

Could you provide the actual query you tried? You may have added commas instead of spaces in lookup command. See this for syntax and example of lookup command: 

https://docs.splunk.com/Documentation/SCS/current/SearchReference/LookupCommandExamples

[gitingua]

index = index

| table username src_ip asn
| lookup username user.csv OUTPUT asn_old
| where asn != asn_old

[nmohammed]

@gitingua 

can you share your search query that you're trying for this result ?