inputlookup csv

[keyu921]

I setup testing.csv lookup as following
host,location
123,HK
234,US
345,UK

I would like to basic search if host matched in the log, stats count by location
index=log sourcetype=csv |search [|inputlookup testing | return $host]
| stats .... by location

But seems return nothings

[keyu921]

index=* sourcetype=csv |search [|inputlookup testing| return 1000 $host]
| stats last(Size) last(Used) last(Use) by host

[gcusello · Accepted solution]

Hi @keyu921,
the command to use is lookup, try something like this:

index=log sourcetype=csv 
| lookup testing.csv host OUTPUT location
| stats count by location

Remember to define Lookup definitions.

Ciao.
Giuseppe

[keyu921]

thanks seems i mix up inputlookup and lookup