https://community.splunk.com/t5/Splunk-Search/How-to-search-csv-for-values-in-a-lookup-table/m-p/493531#M137649 <P>I have a large csv with lots of columns and a lookup table below</P> <PRE><CODE>payload *.exe *.zip *.7z </CODE></PRE> <P>How do I search all fields for values in my lookup table? For example I want to look for values like "badfile.exe".</P> Mon, 07 Oct 2019 13:19:35 GMT akke 2019-10-07T13:19:35Z https://community.splunk.com/t5/Splunk-Search/How-to-search-csv-for-values-in-a-lookup-table/m-p/493531#M137649 <P>I have a large csv with lots of columns and a lookup table below</P> <PRE><CODE>payload *.exe *.zip *.7z </CODE></PRE> <P>How do I search all fields for values in my lookup table? For example I want to look for values like "badfile.exe".</P> Mon, 07 Oct 2019 13:19:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-csv-for-values-in-a-lookup-table/m-p/493531#M137649 akke 2019-10-07T13:19:35Z https://community.splunk.com/t5/Splunk-Search/How-to-search-csv-for-values-in-a-lookup-table/m-p/493532#M137650 <P>Read the lookup file in a subsearch and use the <CODE>format</CODE> command to help build the main search.</P> <PRE><CODE>index=foo [|inputlookup payload.csv | fields payload | format] </CODE></PRE> <P>will expand into the search <CODE>index=foo (payload=*.exe OR payload=*.zip OR payload=*.7z)</CODE></P> Mon, 07 Oct 2019 13:44:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-csv-for-values-in-a-lookup-table/m-p/493532#M137650 richgalloway 2019-10-07T13:44:40Z