https://community.splunk.com/t5/Splunk-Dev/Lookup-values-with-search-results/m-p/321356#M4519 <PRE><CODE>I have a lookup as mentioned below: Message#, MessageDesc 1234, Error In my search criteria,I am getting output like Message#, Code, _raw,_time 1234, abcd, this error 1234 caused issues, 2017-02-21 06:40:32 Now I want my complete output as Message#, MessageDesc,Code, _raw,_time 1234,Error, abcd, this error 1234 caused issues, 2017-02-21 06:40:32 I tried different options but not able to get the _raw and _time values </CODE></PRE> Tue, 21 Feb 2017 18:55:14 GMT avaishsplunk 2017-02-21T18:55:14Z https://community.splunk.com/t5/Splunk-Dev/Lookup-values-with-search-results/m-p/321356#M4519 <PRE><CODE>I have a lookup as mentioned below: Message#, MessageDesc 1234, Error In my search criteria,I am getting output like Message#, Code, _raw,_time 1234, abcd, this error 1234 caused issues, 2017-02-21 06:40:32 Now I want my complete output as Message#, MessageDesc,Code, _raw,_time 1234,Error, abcd, this error 1234 caused issues, 2017-02-21 06:40:32 I tried different options but not able to get the _raw and _time values </CODE></PRE> Tue, 21 Feb 2017 18:55:14 GMT https://community.splunk.com/t5/Splunk-Dev/Lookup-values-with-search-results/m-p/321356#M4519 avaishsplunk 2017-02-21T18:55:14Z https://community.splunk.com/t5/Splunk-Dev/Lookup-values-with-search-results/m-p/321357#M4520 <P>You need to do other way around. Try this (check the field names should be exactly same)</P> <PRE><CODE>your current search giving fields Message#, Code, _raw,_time | lookup yourlookup.csv "Message#" OUTPUT MessageDesc | table Message#, MessageDesc,Code, _raw,_time </CODE></PRE> Tue, 21 Feb 2017 20:18:10 GMT https://community.splunk.com/t5/Splunk-Dev/Lookup-values-with-search-results/m-p/321357#M4520 somesoni2 2017-02-21T20:18:10Z https://community.splunk.com/t5/Splunk-Dev/Lookup-values-with-search-results/m-p/321358#M4521 <P>Thanks I was able to figure out the issue and have used the same logic but thanks a lot for the prompt help</P> Tue, 21 Feb 2017 21:26:42 GMT https://community.splunk.com/t5/Splunk-Dev/Lookup-values-with-search-results/m-p/321358#M4521 avaishsplunk 2017-02-21T21:26:42Z