How to use a lookup after an inputlookup

[atsin]

I can't get a search to work, the column I want to add with a lookup stays empty.

The following example lookup I'm using:
Value1, value 2
1337, leet
n00b, splunknoob

I'm using the following search
[| inputlookup lookupfile
| fields value1]
| lookup lookupfile value1 output value2

I want to find events with value 1 and add a new column value 2 for readability. Can someone help me?

[gcusello]

Hi @atsin,
at first to use a subsearch to filter events you must have the same field name both in main search and in subsearch.
So if in main search you have a field called my_field1 and in lookup you have the same field called my_field2, you have to rename it.
Then you can use the lookup to add the other fields.
So please try something like this:

index=my_index [ | inputlookup lookupfile | rename my_field2 AS my_field1 | fields my_field1 ]
| lookup lookupfile my_field2 AS my_field1 OUTPUT second_field
| table _time my_field1 second_field

If instead you want to search the lookup value as free text search because you haven't my_field1, it's more complicate:
you can run

index=my_index [ | inputlookup lookupfile | rename my_field2 AS query | fields query ]
| ...

in this way you run a free text search, but the problem is that you haven't a field to use in lookup, so you should use a workaround like this:

index=my_index [ | inputlookup lookupfile | rename my_field2 AS query | fields query ]
| rename _raw as rawText
| eval foo=[
      | inputlookup lookupfile  
      | eval query="%"+my_field2+"%" 
      | stats values(query) AS query 
      | eval query=mvjoin(query,",") 
      | fields query 
      | format "" "" "" "" "" ""
      ]
| eval foo=split(foo,",") 
| mvexpand foo 
| where like(rawText,foo)
| rex field=foo "\%(?<my_field1>[^\%]*)\%"
| lookup lookupfile my_field2 AS my_field1 OUTPUT second_field
| table _time my_field1 second_field

Ciao.
Giuseppe