https://community.splunk.com/t5/Splunk-Search/Where-Search-clause-does-not-work-with-lookup/m-p/667870#M229139 <P>The fact that you are using eval is expected but does not help identify where the problem is,&nbsp;<SPAN>please share your data (anonymised where appropriate).</SPAN></P> Wed, 08 Nov 2023 12:38:04 GMT ITWhisperer 2023-11-08T12:38:04Z https://community.splunk.com/t5/Splunk-Search/Where-Search-clause-does-not-work-with-lookup/m-p/667849#M229132 <P>I am&nbsp; having trouble comparing the columns age and expectedAge, where the column expectedAge is a result of a lookup table. I tried the comparison with "where" as well as "search" clauses. Neither of them worked. I just simply want to select the rows where age &gt; expectedAge.<BR /><BR />Expected behaviour :</P><P>Return rows where the above mentioned condition is met.</P><P>&nbsp;</P><P>Actual behaviour :</P><P>Returns nothing.<BR /><BR /></P><P>&nbsp;</P><LI-CODE lang="markup">| eval age=bla..bla..bla | lookup "expected_age_lookup" dummy_s as s OUTPUT expected_age | fillnull value=777 expected_age | rename expected_age as expectedAge | search age &gt; expectedAge | convert ctime(dummy_Time) | table age,s,dummy_Time,expectedAge</LI-CODE><P>&nbsp;</P><P>&nbsp;</P><P>If I remove the lines following (and including) the where/search clause, I see the results of the lookup.&nbsp;<BR /><BR />How can I achieve this correctly ?</P> Wed, 08 Nov 2023 11:30:14 GMT https://community.splunk.com/t5/Splunk-Search/Where-Search-clause-does-not-work-with-lookup/m-p/667849#M229132 sherwin_r 2023-11-08T11:30:14Z https://community.splunk.com/t5/Splunk-Search/Where-Search-clause-does-not-work-with-lookup/m-p/667851#M229133 <P>The where command should work assuming your data is consistent with the condition, i.e. both fields hold numerics. If it is still not working, please share your data (anonymised where appropriate).</P> Wed, 08 Nov 2023 11:52:57 GMT https://community.splunk.com/t5/Splunk-Search/Where-Search-clause-does-not-work-with-lookup/m-p/667851#M229133 ITWhisperer 2023-11-08T11:52:57Z https://community.splunk.com/t5/Splunk-Search/Where-Search-clause-does-not-work-with-lookup/m-p/667856#M229137 <P>The data is complete in my case, because they are evaluated fields. One thing to note is that The column age is in a float format and expectedAge is in int format (Atleast looks like that).</P> Wed, 08 Nov 2023 12:14:39 GMT https://community.splunk.com/t5/Splunk-Search/Where-Search-clause-does-not-work-with-lookup/m-p/667856#M229137 sherwin_r 2023-11-08T12:14:39Z https://community.splunk.com/t5/Splunk-Search/Where-Search-clause-does-not-work-with-lookup/m-p/667870#M229139 <P>The fact that you are using eval is expected but does not help identify where the problem is,&nbsp;<SPAN>please share your data (anonymised where appropriate).</SPAN></P> Wed, 08 Nov 2023 12:38:04 GMT https://community.splunk.com/t5/Splunk-Search/Where-Search-clause-does-not-work-with-lookup/m-p/667870#M229139 ITWhisperer 2023-11-08T12:38:04Z