Hey all, Does anyone know why this isn't working (I'm a new Splunk user)? I'm trying to show the errorMessageFilter, errorCode and errorAlertValue from the CSV file in the table. CSV file: errorMessage,errorMessageFilter,errorCode,errorAlertValue Test1,Value1,1,10 Test2,Value2,2,10 Test3,Value3,3,100 Test4,Value4,5,100 Test5,Value5,5,100 And this is my query so far: index = index1 cf_app_name = app1 [ | inputlookup critical_errors.csv | table errorMessageFilter | rename errorMessageFilter as msg | format ] AND NOT NULL | lookup critical_errors.csv errorMessageFilter OUTPUT errorCode, errorAlertValue | eval time = strftime(timestamp/1000000000,"%a %b %d, %Y, %T") | table time, cf_space_name, cf_app_name, msg, errorCode, errorAlertValue   Everything in the table results shows fine, with the exception of errorCode and errorAlertValue. These 2 are empty.  ... View more

Hi all, Very new to Splunk here. I'm hoping to get some help. I'm trying to use some of the values in my CSV file as search filters. I suck at explaining, but I'll try anyway. This is what my CSV file looks like:   errorMessage,errorMessageFilter,errorCode,errorAlertValue Test1,Value1,1,10 Test2,Value2,2,10 Test3,Value3,3,100 Test4,Value4,5,100 Test5,Value5,5,100 And my search is structured like this: index=testing application=app1 msg=?? What I'm trying to accomplish is that the ?? part gets populated with values from the CSV file. Specifically, all the values found in errorMessageFilter (so Value1, Value2 etc.)   What do I need to do to make it so the end result would look something like this (using the CSV file): index=testing application=app1 msg="Value1" OR "Value2" OR "Value3" OR "Value4" OR "Value5"   Thanks! ... View more