Hi, I have index data as below and i have kvstores per each account which has additional info. Example Scenario (account numbers and corresponding kvstores: Index data: AccountID ResourceID Account1 Resource1.1 Account1 Resource1.2 Account2 Resource2.1 Account2 Resource2.2 KVStores: Account1_Collection ResourceID IP Resource1.1 1.1.0.0 Resource1.2 1.1.1.1 Account2_Collection ResourceID IP Resource2.1 2.2.0.0 Resource2.2 2.2.1.1 Required output: AccountID ResourceID IP Account1 Resource1.1 1.1.0.0 Account1 Resource1.2 1.1.1.1 Account2 Resource2.1 2.2.0.0 Account2 Resource2.2 2.2.1.1 I used approach mentioned in the answer here Solved: How to use a variable to determine which CSV looku... - Splunk Community, ... | eval keyA=if(fieldX="value1"), fieldX, null()) | lookup lookupA keyA
| eval keyB=if(fieldX="value2"), fieldX, null()) | lookup lookupB keyB
| eval keyC=if(fieldX="value3"), fieldX, null()) | lookup lookupC keyC but this approach does not make it dynamic, if i have new value and hence new lookup, i need to update the searches.. I want to make the search dynamically pick the correct lookup based on the value in event. Thanks in advance, SN
... View more