https://community.splunk.com/t5/Splunk-Enterprise/search-query-help-for-using-lookup/m-p/554498#M6026 <P><SPAN>Hello,<BR /><BR /></SPAN><SPAN>I am looking to use a lookup in my search query. basically&nbsp; in lookup, I have 2 rows for threshold&nbsp; and I wanted to use them in my search query as 2 column.</SPAN><BR /><SPAN>Screenshot of csv and search query&nbsp; requirement.<BR /><BR /><BR />Lookup<BR /></SPAN></P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Lookup Edit _ Splunk 8.1.0.png" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/14477i884D11681A3D0CE0/image-size/large?v=v2&amp;px=999" role="button" title="Lookup Edit _ Splunk 8.1.0.png" alt="Lookup Edit _ Splunk 8.1.0.png" /></span></P><P>expected search query results</P><P><SPAN><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Search _ Splunk 8.1.0.png" style="width: 566px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/14478iFE10A2FA641A48A0/image-size/large?v=v2&amp;px=999" role="button" title="Search _ Splunk 8.1.0.png" alt="Search _ Splunk 8.1.0.png" /></span><BR /><BR />I tried like this. but not sure if there is better way to implement this requirement.<BR /><BR /></SPAN></P><LI-CODE lang="markup">| appendcols [| inputlookup test.csv | table MetricName Threshold | where MetricName="threads" | rename Threshold as nbThreadsThreshold ] | appendcols [| inputlookup test.csv | table MetricName Threshold | where MetricName="openFiles" | rename Threshold as nbOpenFilesThreshold ] | filldown nbThreadsThreshold nbOpenFilesThreshold</LI-CODE><P><SPAN>&nbsp;</SPAN></P><P>&nbsp;</P><P><SPAN>Thanks</SPAN></P><P>&nbsp;</P> Fri, 04 Jun 2021 15:52:01 GMT AKG1_old1 2021-06-04T15:52:01Z https://community.splunk.com/t5/Splunk-Enterprise/search-query-help-for-using-lookup/m-p/554498#M6026 <P><SPAN>Hello,<BR /><BR /></SPAN><SPAN>I am looking to use a lookup in my search query. basically&nbsp; in lookup, I have 2 rows for threshold&nbsp; and I wanted to use them in my search query as 2 column.</SPAN><BR /><SPAN>Screenshot of csv and search query&nbsp; requirement.<BR /><BR /><BR />Lookup<BR /></SPAN></P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Lookup Edit _ Splunk 8.1.0.png" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/14477i884D11681A3D0CE0/image-size/large?v=v2&amp;px=999" role="button" title="Lookup Edit _ Splunk 8.1.0.png" alt="Lookup Edit _ Splunk 8.1.0.png" /></span></P><P>expected search query results</P><P><SPAN><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Search _ Splunk 8.1.0.png" style="width: 566px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/14478iFE10A2FA641A48A0/image-size/large?v=v2&amp;px=999" role="button" title="Search _ Splunk 8.1.0.png" alt="Search _ Splunk 8.1.0.png" /></span><BR /><BR />I tried like this. but not sure if there is better way to implement this requirement.<BR /><BR /></SPAN></P><LI-CODE lang="markup">| appendcols [| inputlookup test.csv | table MetricName Threshold | where MetricName="threads" | rename Threshold as nbThreadsThreshold ] | appendcols [| inputlookup test.csv | table MetricName Threshold | where MetricName="openFiles" | rename Threshold as nbOpenFilesThreshold ] | filldown nbThreadsThreshold nbOpenFilesThreshold</LI-CODE><P><SPAN>&nbsp;</SPAN></P><P>&nbsp;</P><P><SPAN>Thanks</SPAN></P><P>&nbsp;</P> Fri, 04 Jun 2021 15:52:01 GMT https://community.splunk.com/t5/Splunk-Enterprise/search-query-help-for-using-lookup/m-p/554498#M6026 AKG1_old1 2021-06-04T15:52:01Z https://community.splunk.com/t5/Splunk-Enterprise/search-query-help-for-using-lookup/m-p/554514#M6032 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/189181">@AKG1_old1</a>&nbsp;</P><P>Can you please try this?</P><LI-CODE lang="markup">| appendcols [ | inputlookup test.csv | table MetricName Threshold | where MetricName IN ("threads","openFiles") | transpose header_field=MetricName | table threads openFiles] | filldown threads openFiles</LI-CODE><P>&nbsp;</P><P>Thanks<BR />KV<BR />▄︻̷̿┻̿═━一<BR /><BR />If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.&nbsp;</P> Fri, 04 Jun 2021 17:00:18 GMT https://community.splunk.com/t5/Splunk-Enterprise/search-query-help-for-using-lookup/m-p/554514#M6032 kamlesh_vaghela 2021-06-04T17:00:18Z