Lookup error

[splunkn]

We are collecting log files from various components servers.
Eg. Collecting logs from 3 hosts application A [ This is the lookup I have used]
Host1 /app/sdf ; /app/cdf ; /app/ghf
Host2 /app/sdf ; /app/cdf ; /app/ghf
Host3 /app/sdf ; /app/cdf ; /app/ghf ; /app/wer/* [ie. /app/wer/1.log,/app/wer/2.log, /app/wer/2.log, so on]

For unique logs I have no problem I got the query through this,

index=* appid=$appid$ host=$host$ |rename comment as $earliest$ | stats count by host,source | eval type="current" | table host,source,type | append [|inputlookup source.csv | search appid=$appid$ | search host=$host$ | makemv delim=";" source | eval type="existing" | table appid,host,source,type] | stats values(type) as type by host,source | where mvcount(type) =1 | eval reason=if(type="current","Newlogfile","Missingfile") | table host,reason | search reason="Missingfile"

I am having two dropdowns for inputs appid and host. It goes fine while dealing with unique files
i.e For (/app/sdf ; /app/cdf ; /app/ghf ) it matches correctly and return the results.
But for logs using wildcard, Im confused 😞 [/app/wer/]
How to match (/app/wer/) with lookup values?

Kindly suggest some solutions

[martin_mueller]

The error suggests your lookup is all input fields and no output fields, so there'd be nothing for Splunk to do. Make sure you use OUTPUT or OUTPUTNEW to split the input fields from the output fields in your LOOKUP-foo definition.

http://docs.splunk.com/Documentation/Splunk/6.1.3/Knowledge/Addfieldsfromexternaldatasources#Set_up_...

[splunkn]

Martin, thanks for your response. Still am not getting what I want. I have edited the question now
Could you please suggest? Thanks in advance