Hi All, I found the solution for this , Will take a chance to update the answer here Firstly I had written the regex to extract the multiple values of MID's and TID's from the raw logs sourcetype=mysourcetype TID MID | rex max_match=50 "<MID>(?P<mid_extracted>[^\<]+)"|rex max_match=50 "TID\=\"(?P<tid_extracted>[^\"]+)" |table mid_extracted , tid_extracted Now to split the multiple values in a singe event used > MVEXPAND and finally performed the join with the externally uploaded lookup file .Lookup table contains 2 columns . one is MID Values/TID Values second one is Status .Under MID Values/Tid Values columns we have all the values to be checked and in second column all the values were written as MATCHED The final query having join condition is as below sourcetype=mysourcetype TID MID |rex max_match=50 "TID\=\"(?P<tid_extracted>[^\"]+)" |mvexpand tid_extracted |table tid_extracted |join type=left tid_extracted [| inputlookup tid_test.csv] Now If any value in Splunk extracted output matches the value in Lookup file , The status field value displays as MATCHED else displays empty value Note: In lookup file the column heading should be exactly as splunk output field heading means tid_extraced should be same ... View more