https://community.splunk.com/t5/Splunk-Enterprise-Security/Passing-Variable-to-Inputlookup/m-p/488270#M8148 <P>This worked perfectly!<BR /> Thanks a lot for your prompt response...</P> Tue, 28 Apr 2020 16:25:55 GMT geekf 2020-04-28T16:25:55Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Passing-Variable-to-Inputlookup/m-p/488268#M8146 <P>I am running a query to find the list of users that received an email from a particular email address. This is working fine until I try to get more details by using Inputlookup. I want to use Inputlookup to get more details about the users like their department, location, etc which can only be done through that. I need to pass the results from the search to get the other details. The search lists all the userids since I strip out the domain by using the regex.</P> <P>Here is my query:</P> <P><CODE>sourcettype=sendmail to=* <BR /> [ search sourcetype=sendmail from=email@gmail.com <BR /> | fields qid] <BR /> | rex field=orig_recipient "(?[^@]+)" <BR /> | dedup orig_recipient <BR /> | inputlookup append=t identity_lookup_expanded where * identity=$orig_recipient$] <BR /> | table orig_recipient dept email some other fields</CODE></P> <P>Any help would be appreciated!</P> Tue, 28 Apr 2020 12:28:35 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Passing-Variable-to-Inputlookup/m-p/488268#M8146 geekf 2020-04-28T12:28:35Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Passing-Variable-to-Inputlookup/m-p/488269#M8147 <P>The <CODE>$</CODE> operator only applies in the <CODE>map</CODE> command and when referencing inputs to a dashboard.<BR /> Why use <CODE>inputlookup</CODE> here? Why not <CODE>lookup identity_lookup_expanded email as orig_recipient OUTPUT bunit, work_city, work_country</CODE>?</P> Tue, 28 Apr 2020 15:32:41 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Passing-Variable-to-Inputlookup/m-p/488269#M8147 richgalloway 2020-04-28T15:32:41Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Passing-Variable-to-Inputlookup/m-p/488270#M8148 <P>This worked perfectly!<BR /> Thanks a lot for your prompt response...</P> Tue, 28 Apr 2020 16:25:55 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Passing-Variable-to-Inputlookup/m-p/488270#M8148 geekf 2020-04-28T16:25:55Z