https://community.splunk.com/t5/Splunk-Search/inputlookup-help-no-result-match-substring-in-extracted-field/m-p/49232#M11786 <P>You will need t use a subsearch to perform that kind of search.</P> <P>Please read <A href="http://docs.splunk.com/Documentation/Splunk/latest/User/Subsearchtutorial">http://docs.splunk.com/Documentation/Splunk/latest/User/Subsearchtutorial</A></P> <P>and <A href="http://docs.splunk.com/Documentation/Splunk/latest/User/HowSubsearchesWork">http://docs.splunk.com/Documentation/Splunk/latest/User/HowSubsearchesWork</A></P> <P>This should get you to where you need to be.</P> <P>Good luck, hope this helps,</P> <P>MHibbin</P> Sat, 01 Sep 2012 22:00:06 GMT MHibbin 2012-09-01T22:00:06Z https://community.splunk.com/t5/Splunk-Search/inputlookup-help-no-result-match-substring-in-extracted-field/m-p/49231#M11785 <P>This doesnt return anything when i know there are many events with the usernames in the message!</P> <P>this returns a list of the usernames correctly<BR /> |inputlookup list.csv | fields UserLogonName </P> <P>i have an extracted field called Messsage that will have the username SOMEWHERE in the message</P> <P>index = blah Message=”<EM>|inputlookup list.csv | fields UserLogonName</EM>”</P> <P>Thsi doesnt work, no results retrned!</P> <P>PLease help!</P> <P>thanks!</P> Sat, 01 Sep 2012 18:07:44 GMT https://community.splunk.com/t5/Splunk-Search/inputlookup-help-no-result-match-substring-in-extracted-field/m-p/49231#M11785 r999 2012-09-01T18:07:44Z https://community.splunk.com/t5/Splunk-Search/inputlookup-help-no-result-match-substring-in-extracted-field/m-p/49232#M11786 <P>You will need t use a subsearch to perform that kind of search.</P> <P>Please read <A href="http://docs.splunk.com/Documentation/Splunk/latest/User/Subsearchtutorial">http://docs.splunk.com/Documentation/Splunk/latest/User/Subsearchtutorial</A></P> <P>and <A href="http://docs.splunk.com/Documentation/Splunk/latest/User/HowSubsearchesWork">http://docs.splunk.com/Documentation/Splunk/latest/User/HowSubsearchesWork</A></P> <P>This should get you to where you need to be.</P> <P>Good luck, hope this helps,</P> <P>MHibbin</P> Sat, 01 Sep 2012 22:00:06 GMT https://community.splunk.com/t5/Splunk-Search/inputlookup-help-no-result-match-substring-in-extracted-field/m-p/49232#M11786 MHibbin 2012-09-01T22:00:06Z