topic can i use the or condition in lookups ?? in Splunk Search https://community.splunk.com/t5/Splunk-Search/can-i-use-the-or-condition-in-lookups/m-p/97853#M25251 <P>Hi..</P> <P>My Keyword , value<BR /> ABC A <BR /> ABC B<BR /> ABC C<BR /> XYZ D</P> <P>These are the values that i have in lookup table..for the values "A","B",and "C" i have to replace with keyword "ABC" ..Now suppose value "A" has 10 occurences , "B" has 5 occurences and "C" has 2 occurences..</P> <P>When i use the top command with the Mykeyword .it has to show the following stats for me..<BR /> say ..</P> <P>ABC 17 (here 17 is the summation of 10 ,5 and 2 )<BR /> XYZ (some value)</P> <P>how can i do this ??? Is it possible to give a OR condition in lookup table ??</P> <P>Please help .. </P> Mon, 22 Oct 2012 10:02:12 GMT rakesh_498115 2012-10-22T10:02:12Z can i use the or condition in lookups ?? https://community.splunk.com/t5/Splunk-Search/can-i-use-the-or-condition-in-lookups/m-p/97853#M25251 <P>Hi..</P> <P>My Keyword , value<BR /> ABC A <BR /> ABC B<BR /> ABC C<BR /> XYZ D</P> <P>These are the values that i have in lookup table..for the values "A","B",and "C" i have to replace with keyword "ABC" ..Now suppose value "A" has 10 occurences , "B" has 5 occurences and "C" has 2 occurences..</P> <P>When i use the top command with the Mykeyword .it has to show the following stats for me..<BR /> say ..</P> <P>ABC 17 (here 17 is the summation of 10 ,5 and 2 )<BR /> XYZ (some value)</P> <P>how can i do this ??? Is it possible to give a OR condition in lookup table ??</P> <P>Please help .. </P> Mon, 22 Oct 2012 10:02:12 GMT https://community.splunk.com/t5/Splunk-Search/can-i-use-the-or-condition-in-lookups/m-p/97853#M25251 rakesh_498115 2012-10-22T10:02:12Z Re: can i use the or condition in lookups ?? https://community.splunk.com/t5/Splunk-Search/can-i-use-the-or-condition-in-lookups/m-p/97854#M25252 <P>Why not do </P> <PRE><CODE>... | top myKeyword by value </CODE></PRE> <P>instead of </P> <PRE><CODE>.... | top myKeyword </CODE></PRE> <P>Also, it would be helpful if you showed your exact searches, and possibly a sample of some "real" data. This is a bit abstract and difficult to follow. So my answer is just a guess.</P> Mon, 22 Oct 2012 21:00:41 GMT https://community.splunk.com/t5/Splunk-Search/can-i-use-the-or-condition-in-lookups/m-p/97854#M25252 lguinn2 2012-10-22T21:00:41Z