https://community.splunk.com/t5/Splunk-Search/Using-a-lookup-to-filter-sourcetype/m-p/609803#M212058 <P>Hi all,</P><P>I have a lookup instance_list, which I'm trying to use to filter my flow logs to only show the logs with the sourcetype as one of the instances I'm interested in, so:</P><P>index="sample_data" [|inputlookup instance_list | search instancename="*dc*" | lookup eni_list instanceid OUTPUT eni as sourcetype | format] | ......</P><P>There are 3-6 instances that match the search="*dc*" - running the inputlookup section on its own produces the correct list. &nbsp;Unfortunately I get no results, and applying the instance names to each log then filtering results in a really slow search.</P><P>Any pointers are really welcome!</P> Wed, 17 Aug 2022 10:27:47 GMT Mattjj 2022-08-17T10:27:47Z https://community.splunk.com/t5/Splunk-Search/Using-a-lookup-to-filter-sourcetype/m-p/609803#M212058 <P>Hi all,</P><P>I have a lookup instance_list, which I'm trying to use to filter my flow logs to only show the logs with the sourcetype as one of the instances I'm interested in, so:</P><P>index="sample_data" [|inputlookup instance_list | search instancename="*dc*" | lookup eni_list instanceid OUTPUT eni as sourcetype | format] | ......</P><P>There are 3-6 instances that match the search="*dc*" - running the inputlookup section on its own produces the correct list. &nbsp;Unfortunately I get no results, and applying the instance names to each log then filtering results in a really slow search.</P><P>Any pointers are really welcome!</P> Wed, 17 Aug 2022 10:27:47 GMT https://community.splunk.com/t5/Splunk-Search/Using-a-lookup-to-filter-sourcetype/m-p/609803#M212058 Mattjj 2022-08-17T10:27:47Z https://community.splunk.com/t5/Splunk-Search/Using-a-lookup-to-filter-sourcetype/m-p/609804#M212059 <LI-CODE lang="markup">index="sample_data" [|inputlookup instance_list | search instancename="*dc*" | lookup eni_list instanceid OUTPUT eni as sourcetype | fields sourcetype ] | ......</LI-CODE> Wed, 17 Aug 2022 10:31:26 GMT https://community.splunk.com/t5/Splunk-Search/Using-a-lookup-to-filter-sourcetype/m-p/609804#M212059 ITWhisperer 2022-08-17T10:31:26Z https://community.splunk.com/t5/Splunk-Search/Using-a-lookup-to-filter-sourcetype/m-p/609806#M212061 <P>Works perfectly, thanks!</P> Wed, 17 Aug 2022 11:27:44 GMT https://community.splunk.com/t5/Splunk-Search/Using-a-lookup-to-filter-sourcetype/m-p/609806#M212061 Mattjj 2022-08-17T11:27:44Z