FAQ: Can I use multiple files with match()

You can perform a search and lookup with the match() function across multiple files for a given field by making use of the case statement. This can be useful if the size of the lookup files exceeds the maximum size of a single file, or if you have multiple files that cover a different range of values, for example public and private name lookups.

By using a case statement, you can make the lookup part of a single clause in the query. For example:

case {
  match(file="mac_addresses_1.csv", mode="glob", field="mac_address");
  match(file="mac_addresses_2.csv", mode="glob", field="mac_address");

This can be reported for as many lookup files as you need.