topic How to add some filters to |lookup ? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/How-to-add-some-filters-to-lookup/m-p/463195#M99521 <P>Hi,<BR /> I use this command for filtration data by lookup file record...<BR /> <CODE>| lookup loopup.csv lookupname AS searchName OUTPUTNEW fieldtype, fieldvalue</CODE><BR /> And I have result from <CODE>index=name</CODE> where field searchName is lookupname.</P> <P>How should I write search that would use for example <CODE>| lookup loopup.csv lookupname AS searchName, lookupname AS searchField OUTPUTNEW fieldtype, fieldvalue</CODE> and take result where field <CODE>searchName</CODE> is <CODE>lookupname</CODE> and <CODE>lookupname</CODE> is <CODE>searchField</CODE></P> Mon, 09 Dec 2019 12:47:44 GMT rendie 2019-12-09T12:47:44Z How to add some filters to |lookup ? https://community.splunk.com/t5/Getting-Data-In/How-to-add-some-filters-to-lookup/m-p/463195#M99521 <P>Hi,<BR /> I use this command for filtration data by lookup file record...<BR /> <CODE>| lookup loopup.csv lookupname AS searchName OUTPUTNEW fieldtype, fieldvalue</CODE><BR /> And I have result from <CODE>index=name</CODE> where field searchName is lookupname.</P> <P>How should I write search that would use for example <CODE>| lookup loopup.csv lookupname AS searchName, lookupname AS searchField OUTPUTNEW fieldtype, fieldvalue</CODE> and take result where field <CODE>searchName</CODE> is <CODE>lookupname</CODE> and <CODE>lookupname</CODE> is <CODE>searchField</CODE></P> Mon, 09 Dec 2019 12:47:44 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-add-some-filters-to-lookup/m-p/463195#M99521 rendie 2019-12-09T12:47:44Z Re: How to add some filters to |lookup ? https://community.splunk.com/t5/Getting-Data-In/How-to-add-some-filters-to-lookup/m-p/463196#M99522 <P>Hi @rendie,<BR /> I'm not sure to have completely understood your request: you want to add fieldtype and fieldvalue when lookupname matches searchName and searchField, is it correct?<BR /> if this is your request, please, try to use two time lookup command:</P> <PRE><CODE>Your_search | lookup loopup.csv lookupname AS searchName OUTPUT fieldtype AS fieldtype1 fieldvalue AS fieldvalue1 | lookup loopup.csv lookupname AS searchField OUTPUT fieldtype AS fieldtype2 fieldvalue AS fieldvalue2 | ... </CODE></PRE> <P>Ciao.<BR /> Giuseppe</P> Mon, 09 Dec 2019 14:38:21 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-add-some-filters-to-lookup/m-p/463196#M99522 gcusello 2019-12-09T14:38:21Z