https://community.splunk.com/t5/Dashboards-Visualizations/How-to-return-values-from-lookup-table-based-on-input-given/m-p/624125#M51166 <P>I have a lookup table with three columns Endpoints, Rate, Window<BR />I want to get the window value for a particular endpoint provided by me which i will use in my main query<BR /><BR />The Query looks like this<BR /><BR />sourcetype="blabla" http_url = "some endpoint"<BR />minutesago= |inputlookup SomeFile.csv | search Endpoint = "Some endpoint" | return Window<BR /><BR />I get an error running this query<BR /><SPAN>Error in 'search' command: Unable to parse the search: Comparator '=' is missing a term on the right hand side.</SPAN><BR /><BR />Can anyone help?</P> Tue, 13 Dec 2022 15:16:38 GMT amitrinx 2022-12-13T15:16:38Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-return-values-from-lookup-table-based-on-input-given/m-p/624125#M51166 <P>I have a lookup table with three columns Endpoints, Rate, Window<BR />I want to get the window value for a particular endpoint provided by me which i will use in my main query<BR /><BR />The Query looks like this<BR /><BR />sourcetype="blabla" http_url = "some endpoint"<BR />minutesago= |inputlookup SomeFile.csv | search Endpoint = "Some endpoint" | return Window<BR /><BR />I get an error running this query<BR /><SPAN>Error in 'search' command: Unable to parse the search: Comparator '=' is missing a term on the right hand side.</SPAN><BR /><BR />Can anyone help?</P> Tue, 13 Dec 2022 15:16:38 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-return-values-from-lookup-table-based-on-input-given/m-p/624125#M51166 amitrinx 2022-12-13T15:16:38Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-return-values-from-lookup-table-based-on-input-given/m-p/624151#M51171 <P>It looks like you're trying to use a subsearch without putting the subsearch inside brackets.</P><LI-CODE lang="markup">sourcetype="blabla" http_url = "some endpoint" minutesago=[|inputlookup SomeFile.csv | search Endpoint = "Some endpoint" | return $Window]</LI-CODE><P>Using <FONT face="courier new,courier">$Window</FONT> tells the <FONT face="courier new,courier">return</FONT> command to return only the field value rather than a key/value pair.</P> Tue, 13 Dec 2022 15:09:45 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-return-values-from-lookup-table-based-on-input-given/m-p/624151#M51171 richgalloway 2022-12-13T15:09:45Z