https://community.splunk.com/t5/Splunk-Search/REX-and-Lookups/m-p/337882#M100202 <P>I am trying to use a lookup table after I rex out some logs. </P> <P>Here is an example:<BR /> index=* source=messages<BR /> | rex field=_raw "ACTION:[\w]\s(?.*) CODE"<BR /> | outputlookup actions.csv action OUTPUT desc AS desc<BR /> | table _time action desc</P> <P>Can anyone help? Am I doing it wrong? </P> Mon, 16 Apr 2018 18:30:56 GMT HealyManTech 2018-04-16T18:30:56Z https://community.splunk.com/t5/Splunk-Search/REX-and-Lookups/m-p/337882#M100202 <P>I am trying to use a lookup table after I rex out some logs. </P> <P>Here is an example:<BR /> index=* source=messages<BR /> | rex field=_raw "ACTION:[\w]\s(?.*) CODE"<BR /> | outputlookup actions.csv action OUTPUT desc AS desc<BR /> | table _time action desc</P> <P>Can anyone help? Am I doing it wrong? </P> Mon, 16 Apr 2018 18:30:56 GMT https://community.splunk.com/t5/Splunk-Search/REX-and-Lookups/m-p/337882#M100202 HealyManTech 2018-04-16T18:30:56Z https://community.splunk.com/t5/Splunk-Search/REX-and-Lookups/m-p/337883#M100203 <P>I think the display is eating some of your rex, so I'm not sure I can troubleshoot that part directly. If it's working at creating a field called <CODE>action</CODE>, then you should only need to revise your lookup line:</P> <PRE><CODE>| lookup actions.csv action OUTPUT desc AS desc </CODE></PRE> <P>That will work if the events contain a field called <CODE>action</CODE>. If they don't, (say, maybe they contain a field called <CODE>ACTION</CODE>), then you'd do this:</P> <PRE><CODE>| lookup actions.csv action AS ACTION OUTPUT desc AS desc </CODE></PRE> <P>The way you have it now, you are using the command <CODE>outputlookup</CODE>, which is used to literally "output a lookup file" (i.e. create a lookup file) rather than to <EM>use</EM> a lookup file to perform a lookup. </P> Mon, 16 Apr 2018 18:36:58 GMT https://community.splunk.com/t5/Splunk-Search/REX-and-Lookups/m-p/337883#M100203 elliotproebstel 2018-04-16T18:36:58Z