topic Re: How do you compare a field in a search table with a lookup table field? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-do-you-compare-a-field-in-a-search-table-with-a-lookup-table/m-p/457082#M166762 <P>This worked thank you!</P> Thu, 01 Nov 2018 12:33:00 GMT kdelvillar 2018-11-01T12:33:00Z How do you compare a field in a search table with a lookup table field? https://community.splunk.com/t5/Splunk-Search/How-do-you-compare-a-field-in-a-search-table-with-a-lookup-table/m-p/457080#M166760 <P>I have a search that produces a table that contains a field called "http_referer", and I want to compare this field against a field called "TargetURL" that's in my inputlookup redirect-url.csv result. If there's a match I would like it to display all the matches.</P> Thu, 01 Nov 2018 11:36:00 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-compare-a-field-in-a-search-table-with-a-lookup-table/m-p/457080#M166760 kdelvillar 2018-11-01T11:36:00Z Re: How do you compare a field in a search table with a lookup table field? https://community.splunk.com/t5/Splunk-Search/How-do-you-compare-a-field-in-a-search-table-with-a-lookup-table/m-p/457081#M166761 <P>@kdelvillar</P> <P>Have you tried <CODE>lookup</CODE> command? I'm not able to understand all the matches with!!!??</P> <P>Can you please try below search?</P> <PRE><CODE>YOUR_TABLE_SEARCH | lookup redirect-url.csv TargetURL as http_referer OUTPUTNEW TargetURL as myTargetURL | where isnotnull(myTargetURL) </CODE></PRE> <P><A href="https://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Lookup">https://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Lookup</A></P> Thu, 01 Nov 2018 11:44:23 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-compare-a-field-in-a-search-table-with-a-lookup-table/m-p/457081#M166761 kamlesh_vaghela 2018-11-01T11:44:23Z Re: How do you compare a field in a search table with a lookup table field? https://community.splunk.com/t5/Splunk-Search/How-do-you-compare-a-field-in-a-search-table-with-a-lookup-table/m-p/457082#M166762 <P>This worked thank you!</P> Thu, 01 Nov 2018 12:33:00 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-compare-a-field-in-a-search-table-with-a-lookup-table/m-p/457082#M166762 kdelvillar 2018-11-01T12:33:00Z Re: How do you compare a field in a search table with a lookup table field? https://community.splunk.com/t5/Splunk-Search/How-do-you-compare-a-field-in-a-search-table-with-a-lookup-table/m-p/457083#M166763 <P>@kdelvillar</P> <P>Glad to help you. Can you please accept the answer and upvote comment to help the community? </P> Thu, 01 Nov 2018 12:38:48 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-compare-a-field-in-a-search-table-with-a-lookup-table/m-p/457083#M166763 kamlesh_vaghela 2018-11-01T12:38:48Z