https://community.splunk.com/t5/Splunk-Search/search-lookup-table-for-value/m-p/64583#M15962 <P>so I can grep the look-up table to find an entry</P> <P>I can see the contents of the look-up table by doing this<BR /> | inputlookup Domains.csv </P> <P>I want to find a specific entry in the look-up table but I cant seem to find the right syntax</P> <P>I tried this <CODE>| inputlookup Domains.csv | search google.com</CODE></P> <P>and this <CODE>search "google.com" [| inputlookup Domains.csv ]</CODE></P> Fri, 14 Jun 2013 18:52:10 GMT hartfoml 2013-06-14T18:52:10Z https://community.splunk.com/t5/Splunk-Search/search-lookup-table-for-value/m-p/64583#M15962 <P>so I can grep the look-up table to find an entry</P> <P>I can see the contents of the look-up table by doing this<BR /> | inputlookup Domains.csv </P> <P>I want to find a specific entry in the look-up table but I cant seem to find the right syntax</P> <P>I tried this <CODE>| inputlookup Domains.csv | search google.com</CODE></P> <P>and this <CODE>search "google.com" [| inputlookup Domains.csv ]</CODE></P> Fri, 14 Jun 2013 18:52:10 GMT https://community.splunk.com/t5/Splunk-Search/search-lookup-table-for-value/m-p/64583#M15962 hartfoml 2013-06-14T18:52:10Z https://community.splunk.com/t5/Splunk-Search/search-lookup-table-for-value/m-p/64584#M15963 <P>You will have to use the meta data (field) in your search condition. Using a free form search where the job is to find a text string in the raw data will not work. There is no _raw data.</P> <P>For instance, assume that your CSV contains very important domains like so:</P> <PRE><CODE>domain google.com splunk.com theoatmeal.com </CODE></PRE> <P>When you run the search, you get the following results</P> <PRE><CODE>| inputlookup Domains.csv </CODE></PRE> <P><IMG src="http://splunk-base.splunk.com//storage/Untitled301.png" alt="alt text" /></P> <P>If you use the metafield obtained, then you can isolate the most important domain.</P> <PRE><CODE>| inputlookup Domains.csv | search domain="theoatmeal.com" </CODE></PRE> <P><IMG src="http://splunk-base.splunk.com//storage/Untitled302.png" alt="alt text" /></P> <P>Then you can enjoy the most important site on the Web.</P> <HR /> <P>gc</P> Fri, 14 Jun 2013 19:37:34 GMT https://community.splunk.com/t5/Splunk-Search/search-lookup-table-for-value/m-p/64584#M15963 Gilberto_Castil 2013-06-14T19:37:34Z