https://community.splunk.com/t5/Splunk-Search/adding-data-from-lookup-to-search/m-p/250052#M74642 <P>I have a spreadsheet.csv with the following info:<BR /> date, SID<BR /> 16/03/2016, x555xx5x5<BR /> ...</P> <P>I want to add the SID value as Account_Name to search:</P> <P>index=blah source=<EM>blah.log Account_Name=</EM> |stats count</P> <P>Whats the most efficient method and example in distributed environment?</P> <P>Thanks in advance!</P> Wed, 16 Mar 2016 17:16:26 GMT smudge797 2016-03-16T17:16:26Z https://community.splunk.com/t5/Splunk-Search/adding-data-from-lookup-to-search/m-p/250052#M74642 <P>I have a spreadsheet.csv with the following info:<BR /> date, SID<BR /> 16/03/2016, x555xx5x5<BR /> ...</P> <P>I want to add the SID value as Account_Name to search:</P> <P>index=blah source=<EM>blah.log Account_Name=</EM> |stats count</P> <P>Whats the most efficient method and example in distributed environment?</P> <P>Thanks in advance!</P> Wed, 16 Mar 2016 17:16:26 GMT https://community.splunk.com/t5/Splunk-Search/adding-data-from-lookup-to-search/m-p/250052#M74642 smudge797 2016-03-16T17:16:26Z https://community.splunk.com/t5/Splunk-Search/adding-data-from-lookup-to-search/m-p/250053#M74643 <P>Try something like this (based on where you've your csv file, choose between inputcsv( if in $SPLUNK_HOME/var/run/splunk) or inputlookup (if it's added as lookup table file $SPLUNK_HOME/etc/apps/AppName/lookups)</P> <PRE><CODE>index=blah source=*blah.log [inputcsv spreadsheet.csv | stats count by SID | table SID | rename SID as Account_Name] |stats count </CODE></PRE> Tue, 29 Sep 2020 09:04:02 GMT https://community.splunk.com/t5/Splunk-Search/adding-data-from-lookup-to-search/m-p/250053#M74643 somesoni2 2020-09-29T09:04:02Z https://community.splunk.com/t5/Splunk-Search/adding-data-from-lookup-to-search/m-p/250054#M74644 <P>cool thanks!</P> Wed, 16 Mar 2016 22:50:03 GMT https://community.splunk.com/t5/Splunk-Search/adding-data-from-lookup-to-search/m-p/250054#M74644 smudge797 2016-03-16T22:50:03Z