Can I use _row when matching with lookup? It seems to me that it can not be done. Can you give me some hints?
If you search keywords
ex) index=XXX [|inputlookup XXX.csv|table key_value|rename key_value as query]
Look at this https://answers.splunk.com/answers/7472/subsearch-fields-query-search-how-do-i-know-which-to-use.htm...
View solution in original post
Why you want to match _raw data with lookup ? Can't you use any field value to match data with lookup ? If your fields values are not exactly matching with lookup table data then you can implement wildcard lookup.
