I have a lookup table that has a list of values in it similar to: id value 1 test_value1 2 test_value2   I can search for all logs that have any of these values in them by doing: index=blah sourcetype=blah [|inputlookup test_values | rename value AS search | fields search | format] This creates a search such as: index=blah sourcetype=blah ( ( "test_value1" ) OR ( "test_value2" ) ) What I'm trying to figure out is how to know which value from the lookup table was responsible for matching each log. However, because I'm not searching for the values in any particular field in the logs, and the fact that the lookup table values might be substrings of a larger value in the logs, I don't think I can use "| lookup" in order to match back to the lookup table. Put another way that doesn't even necessarily need to involve a lookup table, if you had this search: index=blah sourcetype=blah *this* OR *that* Is there any way to create a new field within the matching logs that would contain either the string "this" or "that" depending on which one was the cause of the match? ... View more