Trying to match a field with multiple values against a lookuptable

[marktechuk]

I trying to search a lookup table for matching field=user the field contains multiple values for example
user=ID, name, email, address - so when I run the search it only match on email the first value in field user against my lookuptable test1.csv

I there a way for my to split out the values of field user into multiple fields that I can match against my lookuptable.

index=** sourcetype=** event=** | table user | dedup user | lookup test1.csv user outputnew user as matchEvent

[mayurr98 · Accepted solution]

have a look at this :

https://answers.splunk.com/answers/548550/match-value-from-lookup-table-to-values-of-multipl.html