I have in my search base a field named 'type' that I need to split into type1 and type2 and to check if one of them exists in my csv file. My search at the moment is giving me a result that both types do not exist in the csv file, this is my query at the moment:    index="example" |eval type1=mvindex(split(type,":"),0) |eval type2=mvindex(split(type,":"),1) |search [|inputlookup myfile.csv  | eval range=mvrange(1,3) | mvexpand range | eval type2=if(range==2,type,null) | eval type1=if(range==1,type,null) | table type1 type2] |table type1 type2   Thanks     ... View more

Yes You right, but is not my problem , I got result with type that not in my csv file Here is my query: index="example" |eval type1=mvindex(split(type,":"),0) |eval type2=mvindex(split(type,":"),1) |search [|inputlookup myfile.csv  | eval range=mvrange(1,3) | mvexpand range | eval type2=if(range==2,type,null) | eval type1=if(range==1,type,null) | table type1 type2] |table type1 type2   Thanks ... View more

@ITWhisperer thank you for your solution, I made some changes in my query, and it dosent work, I would be happy if you can tell me what is the problem Here is my new query: index="example" |eval type1=mvindex(type.split(":"),0) |eval type2=mvindex(type.split(":"),1) |search [|inputlookup myfile.csv  | eval range=mvrange(1,3) | mvexpand range | eval type2=if(range==2,type,null) | eval type1=if(range==1,type,null) | table type1 type2] |table type1 type2   Thank you     ... View more