Appending Lookup Match to Search Results

[driva]

Hi all,

I have a search that filters results based on a lookup file. Is there a simple way that I can add the match from the lookup file to the table/results?

index=web[| inputlookup HighRiskWords.csv | eval HighRiskWords="*"+HighRiskWords+"*" | rename HighRiskWords as web_Search] | stats count by web_Search, web_User, _time

It would be great to have the final piece of the search to be: Web_Search, {web_MatchingLookup}, web_user, _time

Thanks!

[13tsavage]

Can you elaborate and provide more details to what exactly you are trying to do?

[starcher]

don't do that. use a lookup as a lookup and make it a wildcard match type.

index=web 
| lookup HighRiskWords web_Search outputnew web_Search as isFound
| where isnotnull(isFound)
| stats count by web_Search, web_User, _time

[starcher]

https://docs.splunk.com/Documentation/Splunk/8.0.1/Knowledge/Usefieldlookupstoaddinformationtoyourev...