How to search multiple strings from lookup and provide count?

[Splunk4]

Hi All,

I am working on search to search fields values from the lookup in an index and i have created the below search :

index="nch_apps_nonprod" 
[| inputlookup WAS_ErrorCode.csv | table WASEventCode | rename WASEventCode as query]
| append
  [| inputlookup WAS_ErrorCode.csv
  | stats values(WASEventCode) as WASEventCode]



| eventstats values(WASEventCode) as WASEventCode
| where isnotnull(_raw)
| eval WASEventCode=mvmap(WASEventCode,if(match(_raw,WASEventCode),WASEventCode,null()))
| eventstats count as Ecount by WASEventCode | convert ctime(_time) as time| dedup WASEventCode|lookup WAS_ErrorCode.csv WASEventCode OUTPUT Severity2 Description2 Threshold2 WASEventCode | eval Threshold2=mvindex(Threshold2,0) | eval Severity2=mvindex(Severity2,0)| eval Description2=mvindex(Description2,0) | eval WASEventCode=mvindex(WASEventCode,0) | where Ecount>Threshold2 |eval message="mc_host= "+host+"; mc_object= "+source+"; mc_object_class= "+sourcetype+"; mc_origin= "+host+"; msg='"+WASEventCode+" : "+Description2+" with count as "+Ecount+"'; mc_tool_time= "+time+"; mc_origin_sev= "+Severity2+";"|table message

In the above search , i am searching  field values, WASEventcode from the lookup in index.Please note that this field in not present in index and i am doing text search and it is working fine.Now i want to search the condition which would search another field value from the lookup and it should search both field values which is Description2 of the WASEventcode but not able to do the same

[VatsalJagani]

@Splunk4 - Try this instead:

index="nch_apps_nonprod" 
[| inputlookup WAS_ErrorCode.csv | table WASEventCode | return $WASEventCode]

Appending $ makes text search instead of field search.

I hope this helps!!!