How to give each field Additional Information and use this in a search query

[cmak]

I have a bunch of fields, let's say Field A, Field B, Field C.

I want to give each field a certain value.
For example, Field A has value of 2
Field B has value of 1
Field C has value of 2

How should I give Splunk this information?
Should it be in a separate lookup table or just in an addional row in my CSV file?

If so, how can I search and only show fields with a certain value

[cmak]

I have many Fields

Field A, FieldB, Field C, Field D
They each have a weight associated with them.
FieldA : 0
FieldB : 1
FieldC : 0
FieldD : 1

I tried using a lookup table to associate the field with a weight but I cannot seem to be able to do so.

I would like to do queries like:
Just show the fields in the table with weight of 0.
Then only Field A and Field C would show.

[Drainy]

I'm going to take a punt and say you're after an automatic lookup, what you mean by "an additional row in my CSV file?" is a bit beyond us as you haven't mentioned an existing CSV file 😉

In this case I would put it into a lookup such as;

values.csv  
    Field, Value
    A,2
    B,1
    C,2

I would then create an automatic lookup in my props.conf for that sourcetype;

[MYAMAZINGSOURCETYPE]
LOOKUP-values = valuescsv Field OUTPUT Value

In transforms.conf I would define the lookup...

[valuescsv]
filename = values.csv

Finally, you need to take into consideration how the Field value is extracted, presumably this is already handled in your instance but you need to make sure that is extracted BEFORE the automatic lookup.

Otherwise, you can now run a search on that sourcetype for a Value=2 to only see those values.

[Ayn]

There are multiple options, and what suits you depends entirely on what specifically you're trying to do. Could you explain your scenario more in detail?