Can I use _row when matching with lookup?
It seems to me that it can not be done.
Can you give me some hints?
If you search keywords
ex)
index=XXX [|inputlookup XXX.csv|table key_value|rename key_value as query]
Look at this
https://answers.splunk.com/answers/7472/subsearch-fields-query-search-how-do-i-know-which-to-use.htm...
If you search keywords
ex)
index=XXX [|inputlookup XXX.csv|table key_value|rename key_value as query]
Look at this
https://answers.splunk.com/answers/7472/subsearch-fields-query-search-how-do-i-know-which-to-use.htm...
Why you want to match _raw data with lookup ? Can't you use any field value to match data with lookup ? If your fields values are not exactly matching with lookup table data then you can implement wildcard lookup.