topic How do I add fields from a lookup table to my search event? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-do-I-add-fields-from-a-lookup-table-to-my-search-event/m-p/405812#M190917 <P>I have a lookup table geo-lookup.csv which has data in the format:<BR /> IP, Coordinates, Location.</P> <P>My search has the field ipAddress which is used as the filter to match the IP field in the table. I want the Location field to be added to the search events for the matching ipAddress field.</P> <P>I'm using the command:<BR /> base search | lookup geo-lookup IP as ipAddress OUTPUTNEW Location as location</P> <P>Can anyone tell me where I'm going wrong?<BR /> All my permissions and lookup definitions are configured correctly. </P> Wed, 24 Jul 2019 18:38:11 GMT angshul 2019-07-24T18:38:11Z How do I add fields from a lookup table to my search event? https://community.splunk.com/t5/Splunk-Search/How-do-I-add-fields-from-a-lookup-table-to-my-search-event/m-p/405812#M190917 <P>I have a lookup table geo-lookup.csv which has data in the format:<BR /> IP, Coordinates, Location.</P> <P>My search has the field ipAddress which is used as the filter to match the IP field in the table. I want the Location field to be added to the search events for the matching ipAddress field.</P> <P>I'm using the command:<BR /> base search | lookup geo-lookup IP as ipAddress OUTPUTNEW Location as location</P> <P>Can anyone tell me where I'm going wrong?<BR /> All my permissions and lookup definitions are configured correctly. </P> Wed, 24 Jul 2019 18:38:11 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-add-fields-from-a-lookup-table-to-my-search-event/m-p/405812#M190917 angshul 2019-07-24T18:38:11Z Re: How do I add fields from a lookup table to my search event? https://community.splunk.com/t5/Splunk-Search/How-do-I-add-fields-from-a-lookup-table-to-my-search-event/m-p/405813#M190918 <P>@angshul - make sure you mention exact name with csv extension for your lookup. <BR /> base search | lookup geo-lookup.csv IP as ipAddress OUTPUTNEW Location as location</P> Wed, 24 Jul 2019 20:08:01 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-add-fields-from-a-lookup-table-to-my-search-event/m-p/405813#M190918 Vijeta 2019-07-24T20:08:01Z Re: How do I add fields from a lookup table to my search event? https://community.splunk.com/t5/Splunk-Search/How-do-I-add-fields-from-a-lookup-table-to-my-search-event/m-p/405814#M190919 <P>Thanks for the help.<BR /> The issue was I had to use the fields within double quotes.<BR /> Its working now</P> Wed, 24 Jul 2019 20:10:20 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-add-fields-from-a-lookup-table-to-my-search-event/m-p/405814#M190919 angshul 2019-07-24T20:10:20Z