https://community.splunk.com/t5/Splunk-Search/lookup-with-row/m-p/324749#M96852 <P>Why you want to match _raw data with lookup ? Can't you use any field value to match data with lookup ? If your fields values are not exactly matching with lookup table data then you can implement wildcard lookup.</P> Fri, 08 Dec 2017 03:48:21 GMT harsmarvania57 2017-12-08T03:48:21Z https://community.splunk.com/t5/Splunk-Search/lookup-with-row/m-p/324748#M96851 <P>Can I use _row when matching with lookup?<BR /> It seems to me that it can not be done.<BR /> Can you give me some hints?</P> Fri, 08 Dec 2017 03:40:04 GMT https://community.splunk.com/t5/Splunk-Search/lookup-with-row/m-p/324748#M96851 oda 2017-12-08T03:40:04Z https://community.splunk.com/t5/Splunk-Search/lookup-with-row/m-p/324749#M96852 <P>Why you want to match _raw data with lookup ? Can't you use any field value to match data with lookup ? If your fields values are not exactly matching with lookup table data then you can implement wildcard lookup.</P> Fri, 08 Dec 2017 03:48:21 GMT https://community.splunk.com/t5/Splunk-Search/lookup-with-row/m-p/324749#M96852 harsmarvania57 2017-12-08T03:48:21Z https://community.splunk.com/t5/Splunk-Search/lookup-with-row/m-p/324750#M96853 <P>If you search keywords</P> <P>ex)<BR /> index=XXX [|inputlookup XXX.csv|table key_value|rename key_value as query]</P> <P>Look at this<BR /> <A href="https://answers.splunk.com/answers/7472/subsearch-fields-query-search-how-do-i-know-which-to-use.html" target="_blank">https://answers.splunk.com/answers/7472/subsearch-fields-query-search-how-do-i-know-which-to-use.html</A></P> Tue, 29 Sep 2020 17:06:56 GMT https://community.splunk.com/t5/Splunk-Search/lookup-with-row/m-p/324750#M96853 HiroshiSatoh 2020-09-29T17:06:56Z