https://community.splunk.com/t5/Splunk-Search/use-query-as-a-lookup-for-value/m-p/274443#M82781 <P>within an index i have Records with a Name and Id and some with just the ID. </P> <P>sourcetype=A Name="Foo" Id=23<BR /> sourcetype=A Name="Blah" Id=24<BR /> sourcetype=B Id = 24 Message="Found"<BR /> sourcetype=B Id =23 Message="Lost"<BR /> sourcetype=B Id=24 Message="Lost"</P> <P>I am looking to query and get </P> <P>Name="Foo" Id=23 Message="Lost"<BR /> Name="Blah" Id=24 Message="Found"<BR /> Name="Blah" Id=24 Message="Lost"</P> <P>basically wanting to use source a as a lookup i have tried join the syntaxes but no luck</P> Fri, 27 May 2016 13:57:28 GMT leonardr 2016-05-27T13:57:28Z https://community.splunk.com/t5/Splunk-Search/use-query-as-a-lookup-for-value/m-p/274443#M82781 <P>within an index i have Records with a Name and Id and some with just the ID. </P> <P>sourcetype=A Name="Foo" Id=23<BR /> sourcetype=A Name="Blah" Id=24<BR /> sourcetype=B Id = 24 Message="Found"<BR /> sourcetype=B Id =23 Message="Lost"<BR /> sourcetype=B Id=24 Message="Lost"</P> <P>I am looking to query and get </P> <P>Name="Foo" Id=23 Message="Lost"<BR /> Name="Blah" Id=24 Message="Found"<BR /> Name="Blah" Id=24 Message="Lost"</P> <P>basically wanting to use source a as a lookup i have tried join the syntaxes but no luck</P> Fri, 27 May 2016 13:57:28 GMT https://community.splunk.com/t5/Splunk-Search/use-query-as-a-lookup-for-value/m-p/274443#M82781 leonardr 2016-05-27T13:57:28Z https://community.splunk.com/t5/Splunk-Search/use-query-as-a-lookup-for-value/m-p/274444#M82782 <P>Try like this</P> <PRE><CODE>sourcetype=A OR sourcetype=B | stats values(Name) as Name values(Message) as Message by Id </CODE></PRE> Fri, 27 May 2016 14:22:04 GMT https://community.splunk.com/t5/Splunk-Search/use-query-as-a-lookup-for-value/m-p/274444#M82782 somesoni2 2016-05-27T14:22:04Z