https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-figure-out-why-our-semi-dynamic-lookup-is-not/m-p/377058#M110632 <P>If you add <CODE>format</CODE> to your subsearch and run it as a search like this:</P> <PRE><CODE>|inputlookup bbtable.csv | search "Username" = AVCxxxxxxxxxxx | fields "MAC" | dedup "MAC" | format </CODE></PRE> <P>You will see that it is creating something like <CODE>( ( MAC="1:2:3:4:5:6" ) OR ... OR ( MAC="5:6:7:8:9:0" ) )</CODE> which is probably not what you would like because the fieldname in your <CODE>bluecoat</CODE> logs is not <CODE>MAC</CODE> but something else. So do a <CODE>| rename MAC as &lt;other field name&gt;</CODE> or use this to do a fieldless search instead:</P> <PRE><CODE>|inputlookup bbtable.csv | search "Username" = AVCxxxxxxxxxxx | fields "MAC" | dedup "MAC" | format "(" "" "" "" "OR" ")" | rex field=search mode=sed "s/MAC=//g" </CODE></PRE> Sun, 31 Mar 2019 07:53:24 GMT woodcock 2019-03-31T07:53:24Z https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-figure-out-why-our-semi-dynamic-lookup-is-not/m-p/377057#M110631 <P>Hi Splunk Users,</P> <P>My main search to find DHCP Discover logs is as below:</P> <PRE><CODE>index=bluecat (Mac_Address) "DHCPDISCOVER" | table _time message_option mac_address </CODE></PRE> <P>What I am trying to achieve is I have a dashboard, so when I search the Username, it gives me all sorts of information about the Username.</P> <P>My token for the username is $clientip$</P> <P>I need to look up the Mac_Address from another separate CSV table called bbtable.csv and in this table, it includes the username and mac_address details.</P> <P>When I run the lookup separately as below:</P> <PRE><CODE>inputlookup bbtable.csv | search "Username" = AVCxxxxxxxxxxx | fields "MAC" | dedup "MAC" </CODE></PRE> <P>it returns the required mac_address value I need.</P> <P>When I combine the sub-search with my main search as below it fails with the message "No results found. Try expanding the time range." <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span></P> <PRE><CODE>index=bluecat [inputlookup bbtable.csv | search "Username" = AVCxxxxxxxxxxx | fields "MAC" | dedup "MAC"] | table _time message_option mac_address </CODE></PRE> <P>Please help</P> <P>Thank you in advance</P> Tue, 29 Sep 2020 23:50:50 GMT https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-figure-out-why-our-semi-dynamic-lookup-is-not/m-p/377057#M110631 goken 2020-09-29T23:50:50Z https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-figure-out-why-our-semi-dynamic-lookup-is-not/m-p/377058#M110632 <P>If you add <CODE>format</CODE> to your subsearch and run it as a search like this:</P> <PRE><CODE>|inputlookup bbtable.csv | search "Username" = AVCxxxxxxxxxxx | fields "MAC" | dedup "MAC" | format </CODE></PRE> <P>You will see that it is creating something like <CODE>( ( MAC="1:2:3:4:5:6" ) OR ... OR ( MAC="5:6:7:8:9:0" ) )</CODE> which is probably not what you would like because the fieldname in your <CODE>bluecoat</CODE> logs is not <CODE>MAC</CODE> but something else. So do a <CODE>| rename MAC as &lt;other field name&gt;</CODE> or use this to do a fieldless search instead:</P> <PRE><CODE>|inputlookup bbtable.csv | search "Username" = AVCxxxxxxxxxxx | fields "MAC" | dedup "MAC" | format "(" "" "" "" "OR" ")" | rex field=search mode=sed "s/MAC=//g" </CODE></PRE> Sun, 31 Mar 2019 07:53:24 GMT https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-figure-out-why-our-semi-dynamic-lookup-is-not/m-p/377058#M110632 woodcock 2019-03-31T07:53:24Z