https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-lookup-search-to-display-multiple-fields-after/m-p/206889#M60274 <P>Scenario: I am matching dns queries to the domains listed in malware_domainsdm.csv. The .csv has multiple fields that I want to display after it matches the dns query domain to the malware domains.</P> <P>Here is the search I am currently using, it displays the all .csv fields (column headers) but no values. </P> <PRE><CODE>index=DNSlogs | eval reformattedDomain = replace(replace(questionname,"\(\d+\)","."),"\.(.*)\.","\1") | stats count by reformattedDomain | lookup malware_domainsdm.csv domain AS reformattedDomain | eval domainmatch=if(reformatedDomain==domain, "bad", "good") </CODE></PRE> <P>Please provide an example, thank you</P> Fri, 15 Apr 2016 18:57:52 GMT packet_hunter 2016-04-15T18:57:52Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-lookup-search-to-display-multiple-fields-after/m-p/206889#M60274 <P>Scenario: I am matching dns queries to the domains listed in malware_domainsdm.csv. The .csv has multiple fields that I want to display after it matches the dns query domain to the malware domains.</P> <P>Here is the search I am currently using, it displays the all .csv fields (column headers) but no values. </P> <PRE><CODE>index=DNSlogs | eval reformattedDomain = replace(replace(questionname,"\(\d+\)","."),"\.(.*)\.","\1") | stats count by reformattedDomain | lookup malware_domainsdm.csv domain AS reformattedDomain | eval domainmatch=if(reformatedDomain==domain, "bad", "good") </CODE></PRE> <P>Please provide an example, thank you</P> Fri, 15 Apr 2016 18:57:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-lookup-search-to-display-multiple-fields-after/m-p/206889#M60274 packet_hunter 2016-04-15T18:57:52Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-lookup-search-to-display-multiple-fields-after/m-p/206890#M60275 <P>You mean something like</P> <PRE><CODE> |lookup malware_domainsdm.csv domain AS reformattedDomain OUTPUT FieldX FieldY FieldZ </CODE></PRE> <P>Not quite what else you are asking for but the lookup command without OUTPUT should already output all fields by default.</P> Fri, 15 Apr 2016 19:34:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-lookup-search-to-display-multiple-fields-after/m-p/206890#M60275 ryandg 2016-04-15T19:34:19Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-lookup-search-to-display-multiple-fields-after/m-p/206891#M60276 <P>Hi Ryan, you are correct with your answer and I apologize for the confusion on this question. I did not properly test a matching condition. When a matching condition occurs all fields populate. Thank you for your help.</P> Sat, 16 Apr 2016 01:43:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-lookup-search-to-display-multiple-fields-after/m-p/206891#M60276 packet_hunter 2016-04-16T01:43:08Z