New comment on reddit

Let's say your lookup MyLookup has the following fields:

FieldA Gurglepuff Flufflepug 

To get Gurglepuff added to your search, do the following:

index=ndx sourcetype=srctp FieldA=* <rest of search> | lookup MyLookup FieldA OUTPUT Gurglepuff 

You can also match based on multiple fields thusly:

index=ndx sourcetype=srctp FieldA=* <rest of search> | rename ndxField as Flufflepug | lookup MyLookup FieldA Flufflepug OUTPUT Gurglepuff 

Or you can get multiple fields from the lookup:

index=ndx sourcetype=srctp FieldA=* <rest of search> | lookup MyLookup FieldA OUTPUT Gurglepuff Flufflepug