I need to lookup each value in a multivalue field from a lookup table but it seems to only return the first field.
Something like ...|makemv delim="," mvfield|mvexpand mvfield|lookup lookup_table.csv mvfield OUTPUT outfield |table mvfield outfield
would produce something like:
abcdef 1
defddd
dddfeds
However, if I manually created some multivalue fields in the search command, all seems to work fine?
...|eval mv="abab,ddde,ggdfd"|makemv delim="," mv|mvexpand mv|lookup lookup_table.csv mv OUTPUT outfield |table mv outfield
Any idea?
