https://community.splunk.com/t5/Splunk-Search/Appending-Lookup-Match-to-Search-Results/m-p/497218#M138504 <P><A href="https://docs.splunk.com/Documentation/Splunk/8.0.1/Knowledge/Usefieldlookupstoaddinformationtoyourevents">https://docs.splunk.com/Documentation/Splunk/8.0.1/Knowledge/Usefieldlookupstoaddinformationtoyourevents</A></P> Tue, 28 Jan 2020 17:44:23 GMT starcher 2020-01-28T17:44:23Z https://community.splunk.com/t5/Splunk-Search/Appending-Lookup-Match-to-Search-Results/m-p/497216#M138502 <P>Hi all,</P> <P>I have a search that filters results based on a lookup file. Is there a simple way that I can add the match from the lookup file to the table/results?</P> <PRE><CODE>index=web[| inputlookup HighRiskWords.csv | eval HighRiskWords="*"+HighRiskWords+"*" | rename HighRiskWords as web_Search] | stats count by web_Search, web_User, _time </CODE></PRE> <P>It would be great to have the final piece of the search to be: <CODE>Web_Search, {web_MatchingLookup}, web_user, _time</CODE></P> <P>Thanks! </P> Tue, 28 Jan 2020 16:15:12 GMT https://community.splunk.com/t5/Splunk-Search/Appending-Lookup-Match-to-Search-Results/m-p/497216#M138502 driva 2020-01-28T16:15:12Z https://community.splunk.com/t5/Splunk-Search/Appending-Lookup-Match-to-Search-Results/m-p/497217#M138503 <P>don't do that. use a lookup as a lookup and make it a wildcard match type. </P> <PRE><CODE>index=web | lookup HighRiskWords web_Search outputnew web_Search as isFound | where isnotnull(isFound) | stats count by web_Search, web_User, _time </CODE></PRE> Tue, 28 Jan 2020 17:36:17 GMT https://community.splunk.com/t5/Splunk-Search/Appending-Lookup-Match-to-Search-Results/m-p/497217#M138503 starcher 2020-01-28T17:36:17Z https://community.splunk.com/t5/Splunk-Search/Appending-Lookup-Match-to-Search-Results/m-p/497218#M138504 <P><A href="https://docs.splunk.com/Documentation/Splunk/8.0.1/Knowledge/Usefieldlookupstoaddinformationtoyourevents">https://docs.splunk.com/Documentation/Splunk/8.0.1/Knowledge/Usefieldlookupstoaddinformationtoyourevents</A></P> Tue, 28 Jan 2020 17:44:23 GMT https://community.splunk.com/t5/Splunk-Search/Appending-Lookup-Match-to-Search-Results/m-p/497218#M138504 starcher 2020-01-28T17:44:23Z https://community.splunk.com/t5/Splunk-Search/Appending-Lookup-Match-to-Search-Results/m-p/497219#M138505 <P>Can you elaborate and provide more details to what exactly you are trying to do?</P> Tue, 28 Jan 2020 19:01:09 GMT https://community.splunk.com/t5/Splunk-Search/Appending-Lookup-Match-to-Search-Results/m-p/497219#M138505 13tsavage 2020-01-28T19:01:09Z