How to search values in the lookup file?

[prasant]

I have sample.csv file with about 30000 rows with columns:

sample data

data	value1	value2
5600012345	abc	xxx
7890012345	fsfs	rwrr

I have below query

index="b2c"
|rex field=path1.path2.details "code=\'(?<data>[^\n\r\']{10})"

I can see the extracted 'data' field in the fields list.
I want to  query  'data' column values in the csv file and return table with the data and other fields from the event and csv file. how to use inputlookup or lookup command to search the extracted field? Thanks for the help in advance

[prasant]

Thanks..not sure why I keep getting error.. this works though   | search [ | inputlookup sample.csv | fields data]|lookup sample.csv data local=true .
This returned all the other fields from csv file to the 'interesting fields' sidebar.

[bowesmana]

FYI: 

All you need to show a lookup is

| inputlookup sample.csv

prefixing it with search and putting it in a subsearch is not necessary.

but doing that operation is a different thing to doing 

| lookup sample.csv data OUTPUT value1 value2

[richgalloway]

What you describe is exactly what the lookup command does.  You can read about it at https://docs.splunk.com/Documentation/Splunk/9.0.3/SearchReference/Lookup

index="b2c"
|rex field=path1.path2.details "code=\'(?<data>[^\n\r\']{10})"
| lookup sample.csv data OUTPUT value1 value2

[prasant]

Thanks but getting Streamed search execute failed because: Error in 'lookup' command: Could not construct lookup error,

This works though  | search [ | inputlookup sample.csv | fields data]|
but how can I add the other corresponding columns from csv file along with the other fields from the event?

[bowesmana]

The lookup command @richgalloway gave should be correct and is definitely the right way to use a lookup.

Look at this question - it has similarities to yours

https://community.splunk.com/t5/Splunk-Search/Could-not-construct-lookup/m-p/503505