https://community.splunk.com/t5/Splunk-Search/How-to-search-iterate-through-lookup-file/m-p/486515#M136076 <P>I have an input lookup table with a list of user accounts we are trying to search through.</P> <P>Instead of doing <CODE>index=wineventlog EventCode=4624 user=user1 OR user=user2 OR user=user3</CODE>.....etc </P> <P>How can I use the lookup table to search on the user field?<BR /><BR /> As of now, I have this but it is returning no results:</P> <PRE><CODE>index=wineventlog_ad EventCode=4624 [inputlookup user_list_lookup.csv] </CODE></PRE> Thu, 26 Sep 2019 19:22:38 GMT chrisfilor 2019-09-26T19:22:38Z https://community.splunk.com/t5/Splunk-Search/How-to-search-iterate-through-lookup-file/m-p/486515#M136076 <P>I have an input lookup table with a list of user accounts we are trying to search through.</P> <P>Instead of doing <CODE>index=wineventlog EventCode=4624 user=user1 OR user=user2 OR user=user3</CODE>.....etc </P> <P>How can I use the lookup table to search on the user field?<BR /><BR /> As of now, I have this but it is returning no results:</P> <PRE><CODE>index=wineventlog_ad EventCode=4624 [inputlookup user_list_lookup.csv] </CODE></PRE> Thu, 26 Sep 2019 19:22:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-iterate-through-lookup-file/m-p/486515#M136076 chrisfilor 2019-09-26T19:22:38Z https://community.splunk.com/t5/Splunk-Search/How-to-search-iterate-through-lookup-file/m-p/486516#M136077 <P>Use lookups as lookups. and make sure the column name is the same as the user field in the data or use user AS userName or whatever the field is.</P> <P><CODE>index=wineventlog_ad EventCode=4624 | lookup user_list_lookup user OUTPUT user as isFound | where isnotnull(isFound)</CODE></P> Thu, 26 Sep 2019 19:30:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-iterate-through-lookup-file/m-p/486516#M136077 starcher 2019-09-26T19:30:48Z