You're right, it works when I pipe after the lookup. I changed your suggestion a little bit to make it work:
[mysearch] |mylookup.csv host OUTPUT threshold mail
| stats min(use_rate) as min_use_rate values(threshold) as threshold by host, mail
| where min_use_rate > threshold | fields host min_use_rate mail threshold
It separates the result as wanted. Now I have to test it IRL.
This is brilliant, thank you @acfecondo75 for your time!
... View more