I am trying to write a lookup that will pull a value out from one of three different columns.
for example
Col_A, Val_A, Val_B, Val_C
I want to look up only one of the values depending on a field.
So if lookup_field = Val_B , I want to use Col_A and pull out value from Val_B column.
This does the same thing (I do not believe there is a way to do this exactly the way you described):
... | lookup myLookup Col_A OUTPUT Val_A Val_B Val_C | eval desiredValue=case(lookup_field="Val_A", Val_A, lookup_field="Val_B", Val_B, lookup_field="Val_C", Val_C) | fields - Val_*
Can you post some sample data from the lookup?
This is a slightly complicated one - however if you can provide some sample data then there may be a more suitable way to approach the logic here.