https://community.splunk.com/t5/Splunk-Search/lookup-table-issues/m-p/38108#M8650 <P>There are some field name inconsistencies between your description and your example...</P> <P>Based on your description, try this:</P> <PRE><CODE>source="A1.txt" | lookup A1_timer field_A AS field_a | table field_A field_b field_B field_C </CODE></PRE> <P>Three separate steps: search, lookup, and formatting.</P> Wed, 06 Jul 2011 19:06:13 GMT jrwilk01 2011-07-06T19:06:13Z https://community.splunk.com/t5/Splunk-Search/lookup-table-issues/m-p/38107#M8649 <P>I have a lookup table set up like</P> <P>lookup table name A1_timer</P> <PRE><CODE>field_a filed_b test1 value1 test2 value2 </CODE></PRE> <P>source A1 looks like</P> <PRE><CODE>field_A = test1 field_B = foo field_C = bar </CODE></PRE> <P>I would like my output to look like:</P> <P>field_A from source A1, field_b from lookup table A1_timer, field_B from source A1, field_C from source A1</P> <PRE><CODE>source="A1.txt" lookup A1_timer A1_a OUTPUT A1_A A1_timer_b A1_b A1_c </CODE></PRE> <P>the value in the source file A1.txt in filed A1_a is equal to lookup table A1_timer value A1_timer_a</P> <P>I'm also getting sourcetype too small on my lookup table</P> <P>any ideas?</P> Mon, 28 Sep 2020 09:42:54 GMT https://community.splunk.com/t5/Splunk-Search/lookup-table-issues/m-p/38107#M8649 fresned 2020-09-28T09:42:54Z https://community.splunk.com/t5/Splunk-Search/lookup-table-issues/m-p/38108#M8650 <P>There are some field name inconsistencies between your description and your example...</P> <P>Based on your description, try this:</P> <PRE><CODE>source="A1.txt" | lookup A1_timer field_A AS field_a | table field_A field_b field_B field_C </CODE></PRE> <P>Three separate steps: search, lookup, and formatting.</P> Wed, 06 Jul 2011 19:06:13 GMT https://community.splunk.com/t5/Splunk-Search/lookup-table-issues/m-p/38108#M8650 jrwilk01 2011-07-06T19:06:13Z