https://community.splunk.com/t5/Splunk-Search/How-to-append-dynamic-value-to-end-of-search/m-p/589182#M205185 <P>Dear Community</P> <P>I am looking for a way to add a static and a dynamic value at the end of a search to track the status of the (saved) search. I would like to add the dynamic value to be extraced from an CSV-File.</P> <P>&nbsp;</P> <LI-CODE lang="markup">|...base search... | table index, sourcetype, _time..... | append [ makeresults | eval status="completed" | eval ID = missionID&lt;field from input.csv&gt; ] </LI-CODE> <P>&nbsp;</P> <P>Any help is appreciated.</P> <P>&nbsp;</P> <P>&nbsp;</P> Wed, 16 Mar 2022 14:35:46 GMT ub_ik 2022-03-16T14:35:46Z https://community.splunk.com/t5/Splunk-Search/How-to-append-dynamic-value-to-end-of-search/m-p/589182#M205185 <P>Dear Community</P> <P>I am looking for a way to add a static and a dynamic value at the end of a search to track the status of the (saved) search. I would like to add the dynamic value to be extraced from an CSV-File.</P> <P>&nbsp;</P> <LI-CODE lang="markup">|...base search... | table index, sourcetype, _time..... | append [ makeresults | eval status="completed" | eval ID = missionID&lt;field from input.csv&gt; ] </LI-CODE> <P>&nbsp;</P> <P>Any help is appreciated.</P> <P>&nbsp;</P> <P>&nbsp;</P> Wed, 16 Mar 2022 14:35:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-append-dynamic-value-to-end-of-search/m-p/589182#M205185 ub_ik 2022-03-16T14:35:46Z https://community.splunk.com/t5/Splunk-Search/How-to-append-dynamic-value-to-end-of-search/m-p/589193#M205188 <P>Would something like this work for you?</P><LI-CODE lang="markup">|...base search... | table index, sourcetype, _time..... | append [ | makeresults | eval status="completed" ] | append [ | inputlookup input.csv ]</LI-CODE> Tue, 15 Mar 2022 22:00:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-append-dynamic-value-to-end-of-search/m-p/589193#M205188 ITWhisperer 2022-03-15T22:00:15Z https://community.splunk.com/t5/Splunk-Search/How-to-append-dynamic-value-to-end-of-search/m-p/589257#M205208 <P>Thx for your answer. Unfortunately not. I need the field from the lookup on the same line as</P><P>the other evals in the first append.</P><P>&nbsp;</P> Wed, 16 Mar 2022 09:57:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-append-dynamic-value-to-end-of-search/m-p/589257#M205208 ub_ik 2022-03-16T09:57:15Z https://community.splunk.com/t5/Splunk-Search/How-to-append-dynamic-value-to-end-of-search/m-p/589259#M205210 <LI-CODE lang="markup">|...base search... | table index, sourcetype, _time..... | append [ | inputlookup input.csv | eval status="completed"]</LI-CODE> Wed, 16 Mar 2022 10:00:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-append-dynamic-value-to-end-of-search/m-p/589259#M205210 ITWhisperer 2022-03-16T10:00:51Z https://community.splunk.com/t5/Splunk-Search/How-to-append-dynamic-value-to-end-of-search/m-p/589262#M205211 <P>life could be soo easy. thx a lot for your expertise.</P> Wed, 16 Mar 2022 10:44:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-append-dynamic-value-to-end-of-search/m-p/589262#M205211 ub_ik 2022-03-16T10:44:42Z