https://community.splunk.com/t5/Splunk-Search/Lookup-Table/m-p/527977#M149046 <P>Hello All,</P><P>Actually i have an lookup table DIUSERS.csv, i would like to build a query as like below :</P><P>index=* |inputlookup DIUSERS.csv|stats count by src dest user name action index</P><P>But its not working, Please let me know the correct queries.</P><P>&nbsp;</P><P>Thanks.</P> Wed, 04 Nov 2020 17:44:26 GMT mailmetoramu 2020-11-04T17:44:26Z https://community.splunk.com/t5/Splunk-Search/Lookup-Table/m-p/527977#M149046 <P>Hello All,</P><P>Actually i have an lookup table DIUSERS.csv, i would like to build a query as like below :</P><P>index=* |inputlookup DIUSERS.csv|stats count by src dest user name action index</P><P>But its not working, Please let me know the correct queries.</P><P>&nbsp;</P><P>Thanks.</P> Wed, 04 Nov 2020 17:44:26 GMT https://community.splunk.com/t5/Splunk-Search/Lookup-Table/m-p/527977#M149046 mailmetoramu 2020-11-04T17:44:26Z https://community.splunk.com/t5/Splunk-Search/Lookup-Table/m-p/527986#M149051 <P>What problem are you trying to solve with the lookup file?&nbsp; Debugging a query is difficult without knowing the goal.</P><P>Have you read the Search Reference manual to see the differences between <FONT face="courier new,courier">inputlookup</FONT> and <FONT face="courier new,courier">lookup</FONT>?</P> Wed, 04 Nov 2020 18:09:02 GMT https://community.splunk.com/t5/Splunk-Search/Lookup-Table/m-p/527986#M149051 richgalloway 2020-11-04T18:09:02Z