https://community.splunk.com/t5/Splunk-Search/Why-are-my-search-results-are-not-matching-the-lookup-table/m-p/205541#M59759 <P>If I'm understanding you correctly, you would like to remove all events that do not have a matching ip from the lookup? The purpose of a lookup is to enrich your data with extra information that is contained within fields in your lookup. It will not filter your events if they do not match. In order to do this you could simply append "| search oe=<EM>" to the end of your search. Then only events with the field *oe</EM>, which has come from your lookup, will be retained.</P> Fri, 04 Nov 2016 04:54:32 GMT lquinn 2016-11-04T04:54:32Z https://community.splunk.com/t5/Splunk-Search/Why-are-my-search-results-are-not-matching-the-lookup-table/m-p/205540#M59758 <P>I am performing a search where I am making use of a CSV lookup and only get those results that match one of the fields in the lookup. Here's my scrubbed out search </P> <PRE><CODE>index="logs"|regex url = "..."|stats sum(bytes),count(uri) by url ip|lookup csv_lookup ip OUTPUT oe|sort -sum(bytes) </CODE></PRE> <P>This gives out results with the unmatched events along with the matched events. Any idea what's going wrong? </P> Fri, 04 Nov 2016 02:39:41 GMT https://community.splunk.com/t5/Splunk-Search/Why-are-my-search-results-are-not-matching-the-lookup-table/m-p/205540#M59758 raghav130593 2016-11-04T02:39:41Z https://community.splunk.com/t5/Splunk-Search/Why-are-my-search-results-are-not-matching-the-lookup-table/m-p/205541#M59759 <P>If I'm understanding you correctly, you would like to remove all events that do not have a matching ip from the lookup? The purpose of a lookup is to enrich your data with extra information that is contained within fields in your lookup. It will not filter your events if they do not match. In order to do this you could simply append "| search oe=<EM>" to the end of your search. Then only events with the field *oe</EM>, which has come from your lookup, will be retained.</P> Fri, 04 Nov 2016 04:54:32 GMT https://community.splunk.com/t5/Splunk-Search/Why-are-my-search-results-are-not-matching-the-lookup-table/m-p/205541#M59759 lquinn 2016-11-04T04:54:32Z https://community.splunk.com/t5/Splunk-Search/Why-are-my-search-results-are-not-matching-the-lookup-table/m-p/205542#M59760 <P>Great. Sorry I have very limited experience with Splunk hence wasn't aware of that. But, I was able to achieve my result through what you suggested. Thanks.</P> Fri, 04 Nov 2016 07:15:42 GMT https://community.splunk.com/t5/Splunk-Search/Why-are-my-search-results-are-not-matching-the-lookup-table/m-p/205542#M59760 raghav130593 2016-11-04T07:15:42Z