https://community.splunk.com/t5/Getting-Data-In/How-do-I-search-a-match-a-specific-source-against-an-input/m-p/400909#M71392 <P>@blueumbrella,</P> <P>You could use just <CODE>lookup</CODE> instead of <CODE>inputlookup</CODE></P> <P>E.g.</P> <PRE><CODE>source="source.tsv" |lookup appname inputfield AS "field" OUTPUT "your required fields from lookup" </CODE></PRE> Sun, 26 Aug 2018 04:23:33 GMT renjith_nair 2018-08-26T04:23:33Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-search-a-match-a-specific-source-against-an-input/m-p/400908#M71391 <P>I am attempting to run the below, however I am not getting any results. <BR /> <STRONG>source="source.tsv" [|inputlookup appname| fields inputfield AS "field"]</STRONG></P> <P>I can search <STRONG>source="source.tsv"</STRONG> and get the fields displayed, and <STRONG>|inputlookup appname| fields inputfield AS "field"</STRONG> and displays fine, but when I attempt to combine them to get a match, I get no results. I understand that this only provides a result when there is a match but I have inserted a field that should trigger a match.</P> <P>Can anyone please help point me in the right direction?</P> Mon, 13 Aug 2018 22:35:16 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-search-a-match-a-specific-source-against-an-input/m-p/400908#M71391 blueumbrella 2018-08-13T22:35:16Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-search-a-match-a-specific-source-against-an-input/m-p/400909#M71392 <P>@blueumbrella,</P> <P>You could use just <CODE>lookup</CODE> instead of <CODE>inputlookup</CODE></P> <P>E.g.</P> <PRE><CODE>source="source.tsv" |lookup appname inputfield AS "field" OUTPUT "your required fields from lookup" </CODE></PRE> Sun, 26 Aug 2018 04:23:33 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-search-a-match-a-specific-source-against-an-input/m-p/400909#M71392 renjith_nair 2018-08-26T04:23:33Z