lookup table trouble

[williamsmew]

I cant figure this out. I cant get my query to check a lookup to verify if the identified recipient from the phish logs is in the useremail field.

Still struggling with splunk, thanks for the help.

[woodcock]

Like this:

Your Search Here That Has recipient Field
| lookup YourLookupNameHere.csv username AS recipient OUTPUT username AS MATCHED
| where isnotnull(MATCHED)

[ivanreis]

Hi williamsmew, please check this splunk answer, maybe this can help you out with your issue
-> https://answers.splunk.com/answers/588630/understanding-the-lookup-command.html

[arjunpkishore5]

Can you post a sample of your query please?

[marycordova]

and a sample of your data