https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-match-a-field-in-events-to-a-field-in-a/m-p/258891#M77591 <P>Try this (lookup match is case sensitive)</P> <PRE><CODE>index=MRM | eval array=split(_raw,""), userGID*=mvindex(array,9)| lookup C360_USERS.csv USERID AS userGID | where isnotnull(EMPLOYEEID) | table USERID,EMPLOYEEID,AVAYAID,FIRSTNAME,LASTNAME,LOCATIONNAME,JOBCODE,JOBTITLE </CODE></PRE> <P>*<STRONG><EM>OR</EM></STRONG>*</P> <PRE><CODE>| inputlookup C360_USERS.csv [index=MRM | eval array=split(_raw,""), userGID*=mvindex(array,9) | rename userGID AS USERID | table USERID] |table USERID,EMPLOYEEID,AVAYAID,FIRSTNAME,LASTNAME,LOCATIONNAME,JOBCODE,JOBTITLE </CODE></PRE> Tue, 06 Sep 2016 18:41:57 GMT sundareshr 2016-09-06T18:41:57Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-match-a-field-in-events-to-a-field-in-a/m-p/258889#M77589 <P>Lookuptable = C360_USERS.csv<BR /> Fields: USERID,EMPLOYEEID,AVAYAID,FIRSTNAME,LASTNAME,LOCATIONNAME,JOBCODE,JOBTITLE</P> <P>I want to get all the results from the lookuptable matching <STRONG>userGID</STRONG> from the query. How do I join these two fields userGID and <STRONG>USERID</STRONG> and get all the information in a table format?</P> <PRE><CODE>index=MRM | eval array=split(_raw,"*"), userGID=mvindex(array,9)|lookup C360_USER ...... </CODE></PRE> Tue, 06 Sep 2016 18:13:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-match-a-field-in-events-to-a-field-in-a/m-p/258889#M77589 athorat 2016-09-06T18:13:21Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-match-a-field-in-events-to-a-field-in-a/m-p/258890#M77590 <P>Try like this</P> <PRE><CODE>| inputlookup C360_USERS.csv | search [search index=MRM | eval array=split(_raw,""), userGID*=mvindex(array,9 | stats count by userGID | table userGID | rename userGID as USERID] </CODE></PRE> Tue, 06 Sep 2016 18:40:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-match-a-field-in-events-to-a-field-in-a/m-p/258890#M77590 somesoni2 2016-09-06T18:40:44Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-match-a-field-in-events-to-a-field-in-a/m-p/258891#M77591 <P>Try this (lookup match is case sensitive)</P> <PRE><CODE>index=MRM | eval array=split(_raw,""), userGID*=mvindex(array,9)| lookup C360_USERS.csv USERID AS userGID | where isnotnull(EMPLOYEEID) | table USERID,EMPLOYEEID,AVAYAID,FIRSTNAME,LASTNAME,LOCATIONNAME,JOBCODE,JOBTITLE </CODE></PRE> <P>*<STRONG><EM>OR</EM></STRONG>*</P> <PRE><CODE>| inputlookup C360_USERS.csv [index=MRM | eval array=split(_raw,""), userGID*=mvindex(array,9) | rename userGID AS USERID | table USERID] |table USERID,EMPLOYEEID,AVAYAID,FIRSTNAME,LASTNAME,LOCATIONNAME,JOBCODE,JOBTITLE </CODE></PRE> Tue, 06 Sep 2016 18:41:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-match-a-field-in-events-to-a-field-in-a/m-p/258891#M77591 sundareshr 2016-09-06T18:41:57Z