https://community.splunk.com/t5/Splunk-Search/Does-lookup-command-support-OR-Boolean-operation/m-p/286997#M86878 <P><CODE>lookup</CODE> does not, but you may be able to achieve what you're looking for by using a KV Store instead.</P> <P>See this link for configuring a KV Store from a CSV file:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.4.2/Knowledge/ConfigureKVstorelookups">http://docs.splunk.com/Documentation/Splunk/6.4.2/Knowledge/ConfigureKVstorelookups</A></P> <P>And see this link for examples of using a where clause with the KV Store (in the "Filters and queries" section):</P> <P><A href="http://dev.splunk.com/view/SP-CAAAEZH">http://dev.splunk.com/view/SP-CAAAEZH</A></P> Fri, 29 Jul 2016 13:49:54 GMT kbarker302 2016-07-29T13:49:54Z https://community.splunk.com/t5/Splunk-Search/Does-lookup-command-support-OR-Boolean-operation/m-p/286996#M86877 <P>Hello,<BR /> I have events in index 1 and I have lookup table 1 created from a CSV file. I want to lookup events from index 1 in lookup table 1 by following a hierarchical logic:</P> <OL> <LI>lookup where tail number OR flight ID OR operator matches</LI> <LI>AND lookup where airport matches</LI> </OL> <P>My search currently looks like this and it works. Is there a way to simplify it so that one lookup checks tail number then flight id then operator?<BR /> index=index1<BR /> | lookup lookuptable1 id as tailNo airport as iataAirport OUTPUT start_date/time as start_date<BR /> | lookup lookuptable1 id as flightId airport as iataAirport OUTPUTNEW start_date/time as start_date<BR /> | lookup lookuptable1 id as operator airport as iataAirport OUTPUTNEW start_date/time as start_date</P> Tue, 29 Sep 2020 10:25:22 GMT https://community.splunk.com/t5/Splunk-Search/Does-lookup-command-support-OR-Boolean-operation/m-p/286996#M86877 vpao 2020-09-29T10:25:22Z https://community.splunk.com/t5/Splunk-Search/Does-lookup-command-support-OR-Boolean-operation/m-p/286997#M86878 <P><CODE>lookup</CODE> does not, but you may be able to achieve what you're looking for by using a KV Store instead.</P> <P>See this link for configuring a KV Store from a CSV file:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.4.2/Knowledge/ConfigureKVstorelookups">http://docs.splunk.com/Documentation/Splunk/6.4.2/Knowledge/ConfigureKVstorelookups</A></P> <P>And see this link for examples of using a where clause with the KV Store (in the "Filters and queries" section):</P> <P><A href="http://dev.splunk.com/view/SP-CAAAEZH">http://dev.splunk.com/view/SP-CAAAEZH</A></P> Fri, 29 Jul 2016 13:49:54 GMT https://community.splunk.com/t5/Splunk-Search/Does-lookup-command-support-OR-Boolean-operation/m-p/286997#M86878 kbarker302 2016-07-29T13:49:54Z