https://community.splunk.com/t5/Splunk-Search/Compare-a-field-with-lookup-file/m-p/432336#M123537 <P>How about:</P> <PRE><CODE>... mysearch |lookup lookupname lookupnamefield OUTPUT lookupnamefield as dummy|where isnotnull(dummy) </CODE></PRE> Thu, 31 May 2018 13:20:42 GMT sheamus69 2018-05-31T13:20:42Z https://community.splunk.com/t5/Splunk-Search/Compare-a-field-with-lookup-file/m-p/432334#M123535 <P>I was trying to compare searched result with lookup file.<BR /> Is there any to compare results with lookup file.</P> <P>|mysearch<BR /> |append[|inputlookup lookupname|field Lookupfield]<BR /> |where searched=lookupfield</P> <P>this was my search trying but it is not working.</P> Thu, 31 May 2018 05:24:00 GMT https://community.splunk.com/t5/Splunk-Search/Compare-a-field-with-lookup-file/m-p/432334#M123535 praneshjan 2018-05-31T05:24:00Z https://community.splunk.com/t5/Splunk-Search/Compare-a-field-with-lookup-file/m-p/432335#M123536 <P>Try this:</P> <PRE><CODE> ... mysearch [|inputlookup lookupname | fields lookupField|format] </CODE></PRE> <P>Will unpack to this:</P> <PRE><CODE>... mysearch ((lookupField=valueFromLookupRow1) OR (lookupField=valueFromLookupRow2) OR ... ) </CODE></PRE> Thu, 31 May 2018 12:45:55 GMT https://community.splunk.com/t5/Splunk-Search/Compare-a-field-with-lookup-file/m-p/432335#M123536 jkat54 2018-05-31T12:45:55Z https://community.splunk.com/t5/Splunk-Search/Compare-a-field-with-lookup-file/m-p/432336#M123537 <P>How about:</P> <PRE><CODE>... mysearch |lookup lookupname lookupnamefield OUTPUT lookupnamefield as dummy|where isnotnull(dummy) </CODE></PRE> Thu, 31 May 2018 13:20:42 GMT https://community.splunk.com/t5/Splunk-Search/Compare-a-field-with-lookup-file/m-p/432336#M123537 sheamus69 2018-05-31T13:20:42Z