Dear Splunk gurus I am trying to get the lookup command to accept the lookup table name from a variable.  Example:  | eval list2=case(like(llist, "%option1%"), "list_number_1", like(risklist, "%option2%"), "list_number_2") | lookup list2 Name AS value So... I successfully get the right lookup name. If I table out the list2 (|table list2), I can see that list2 equals the name of the right lookup ("list_number_1"). So the eval command works as intended.  If I use "|lookup list_number_1 Name AS value" it works great.  So the lookup command works as intended.  But if I use "|lookup list2 Name AS value" it does not work even though "list2" = "list_number_1".  So it seems the lookup command will not accept a variable even when the variable contains the name of a valid lookup file.  But can that be true? This works everywhere else in Splunk...  ... View more