https://community.splunk.com/t5/Splunk-Search/How-to-use-field-name-as-the-value-passed-into-a-lookup-table/m-p/210661#M61583 <PRE><CODE>| foreach p* [eval val='&lt;&gt;' | lookup wkst_risk_control asset_risk_position AS 'val'] </CODE></PRE> <P>I have 19 separate p extraction fields called <STRONG>p0-p18</STRONG>. I am looking to loop through each of the field names called <STRONG>p</STRONG>* and do a lookup of the name of the field itself from the lookup table wkst_risk_control to get the supplemental data. I am struggling and missing something. Is <CODE>foreach</CODE> the best way or is there a more elegant method?</P> Tue, 29 Sep 2020 11:40:55 GMT TobiasBoone 2020-09-29T11:40:55Z https://community.splunk.com/t5/Splunk-Search/How-to-use-field-name-as-the-value-passed-into-a-lookup-table/m-p/210661#M61583 <PRE><CODE>| foreach p* [eval val='&lt;&gt;' | lookup wkst_risk_control asset_risk_position AS 'val'] </CODE></PRE> <P>I have 19 separate p extraction fields called <STRONG>p0-p18</STRONG>. I am looking to loop through each of the field names called <STRONG>p</STRONG>* and do a lookup of the name of the field itself from the lookup table wkst_risk_control to get the supplemental data. I am struggling and missing something. Is <CODE>foreach</CODE> the best way or is there a more elegant method?</P> Tue, 29 Sep 2020 11:40:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-field-name-as-the-value-passed-into-a-lookup-table/m-p/210661#M61583 TobiasBoone 2020-09-29T11:40:55Z https://community.splunk.com/t5/Splunk-Search/How-to-use-field-name-as-the-value-passed-into-a-lookup-table/m-p/210662#M61584 <P>Something like this should work</P> <PRE><CODE>...| foreach p* [ lookup wkst_risk_control asset_risk_position AS "&lt;&lt;FIELD&gt;&gt;"] </CODE></PRE> Fri, 04 Nov 2016 21:36:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-field-name-as-the-value-passed-into-a-lookup-table/m-p/210662#M61584 somesoni2 2016-11-04T21:36:34Z