topic How to match search with KV lookup files? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-match-search-with-KV-lookup-files/m-p/431699#M123397 <P>Hello,<BR /> I have a KV file that is auto generated with username using a script running every hour. I want to match the username in the KV file with a different index search. I have written the following query but it is always stuck on "Parsing Job". The index contains a user column. The output should be the username that is common in both user table.</P> <PRE><CODE>index=abc | search [| inputlookup Leaver_Lookup.kv | fields "User ID" | rename "User ID" as user | dedup user | table user ] </CODE></PRE> Thu, 14 Mar 2019 01:17:36 GMT kiranpatil1985 2019-03-14T01:17:36Z How to match search with KV lookup files? https://community.splunk.com/t5/Splunk-Search/How-to-match-search-with-KV-lookup-files/m-p/431699#M123397 <P>Hello,<BR /> I have a KV file that is auto generated with username using a script running every hour. I want to match the username in the KV file with a different index search. I have written the following query but it is always stuck on "Parsing Job". The index contains a user column. The output should be the username that is common in both user table.</P> <PRE><CODE>index=abc | search [| inputlookup Leaver_Lookup.kv | fields "User ID" | rename "User ID" as user | dedup user | table user ] </CODE></PRE> Thu, 14 Mar 2019 01:17:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-match-search-with-KV-lookup-files/m-p/431699#M123397 kiranpatil1985 2019-03-14T01:17:36Z Re: How to match search with KV lookup files? https://community.splunk.com/t5/Splunk-Search/How-to-match-search-with-KV-lookup-files/m-p/431700#M123398 <P>Is LOOKUP defined?</P> <PRE><CODE>| inputlookup &lt;lookup-name&gt; where &lt;eval-expression&gt; | ... </CODE></PRE> <P>Is this search working?</P> <PRE><CODE>| inputlookup Leaver_Lookup.kv | fields "User ID" | rename "User ID" as user | dedup user | table user </CODE></PRE> Thu, 14 Mar 2019 05:00:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-match-search-with-KV-lookup-files/m-p/431700#M123398 HiroshiSatoh 2019-03-14T05:00:53Z Re: How to match search with KV lookup files? https://community.splunk.com/t5/Splunk-Search/How-to-match-search-with-KV-lookup-files/m-p/431701#M123399 <P>Yes that search works.</P> Thu, 14 Mar 2019 06:28:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-match-search-with-KV-lookup-files/m-p/431701#M123399 kiranpatil1985 2019-03-14T06:28:38Z