https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-use-a-search-value-or-a-token-in-the/m-p/246537#M73491 <P>The map command should be able to handle this. For example:</P> <PRE><CODE>index=* host=sample_host | dedup host | map search="search * | outputlookup $host$.csv" </CODE></PRE> Thu, 07 Jul 2016 17:06:46 GMT ryanoconnor 2016-07-07T17:06:46Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-use-a-search-value-or-a-token-in-the/m-p/246536#M73490 <P>Hi!</P> <P>Is it possible to pass into lookup's name created by outputlookup command a token or a search value?</P> <P>Smth like this:</P> <PRE><CODE>index=foo | eval week=&lt;here comes some evaluation, e.g. number of week&gt; | outputlookup dataset_$week$.csv </CODE></PRE> <P>I've tried to write it differently, but outputlookup eats all sorts of symbols and just creates files with <CODE>$ ' "</CODE> ` in its name while I wanted <EM>dataset_15.csv</EM></P> Thu, 07 Jul 2016 16:55:11 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-use-a-search-value-or-a-token-in-the/m-p/246536#M73490 iKate 2016-07-07T16:55:11Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-use-a-search-value-or-a-token-in-the/m-p/246537#M73491 <P>The map command should be able to handle this. For example:</P> <PRE><CODE>index=* host=sample_host | dedup host | map search="search * | outputlookup $host$.csv" </CODE></PRE> Thu, 07 Jul 2016 17:06:46 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-use-a-search-value-or-a-token-in-the/m-p/246537#M73491 ryanoconnor 2016-07-07T17:06:46Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-use-a-search-value-or-a-token-in-the/m-p/246538#M73492 <P>Wow! It works, thank you! </P> Thu, 07 Jul 2016 19:15:17 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-use-a-search-value-or-a-token-in-the/m-p/246538#M73492 iKate 2016-07-07T19:15:17Z