https://community.splunk.com/t5/Splunk-Search/splunk/m-p/567773#M197882 <P><SPAN>yourAccount&nbsp; isnt a field name i have to regex it. Can i rex field&nbsp;yourAccount and search with only the account that i have in csv file?<BR /></SPAN></P><P>&nbsp;</P> Tue, 21 Sep 2021 04:31:16 GMT DougiieDee 2021-09-21T04:31:16Z https://community.splunk.com/t5/Splunk-Search/splunk/m-p/567771#M197880 <P>I have a csv file which has field Account and it has over 1000+. In my logs it is named as yourAccount. how do i find the all the account logs from that csv file. Also can i rex the field and have the table for that as well in same query?</P> Tue, 21 Sep 2021 03:45:49 GMT https://community.splunk.com/t5/Splunk-Search/splunk/m-p/567771#M197880 DougiieDee 2021-09-21T03:45:49Z https://community.splunk.com/t5/Splunk-Search/splunk/m-p/567772#M197881 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/235178">@DougiieDee</a>&nbsp;<BR /><BR />you can try to rename the Account field in csv to&nbsp;<SPAN>yourAccount&nbsp; to get the all results from both fields.</SPAN><BR /><BR /></P><P>example</P><P>index=foo sourcetype=bar | table&nbsp;<SPAN>yourAccount&nbsp;</SPAN><BR />| lookup file.csv <SPAN>Account&nbsp;</SPAN>as <SPAN>yourAccount&nbsp;</SPAN></P> Tue, 21 Sep 2021 04:26:59 GMT https://community.splunk.com/t5/Splunk-Search/splunk/m-p/567772#M197881 SanjayReddy 2021-09-21T04:26:59Z https://community.splunk.com/t5/Splunk-Search/splunk/m-p/567773#M197882 <P><SPAN>yourAccount&nbsp; isnt a field name i have to regex it. Can i rex field&nbsp;yourAccount and search with only the account that i have in csv file?<BR /></SPAN></P><P>&nbsp;</P> Tue, 21 Sep 2021 04:31:16 GMT https://community.splunk.com/t5/Splunk-Search/splunk/m-p/567773#M197882 DougiieDee 2021-09-21T04:31:16Z