<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Create lookup without header in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/How-to-create-lookup-without-header/m-p/624655#M107372</link>
    <description>&lt;P&gt;How I can define that the lookup doesn't have a header&amp;nbsp; and the first line is a value&amp;nbsp; ?&lt;/P&gt;</description>
    <pubDate>Sun, 18 Dec 2022 10:34:20 GMT</pubDate>
    <dc:creator>rayar</dc:creator>
    <dc:date>2022-12-18T10:34:20Z</dc:date>
    <item>
      <title>How to create lookup without header?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-create-lookup-without-header/m-p/624653#M107370</link>
      <description>&lt;P&gt;Hi&lt;/P&gt;
&lt;P&gt;I am going to create a DC list lookup daily using&amp;nbsp;nslookup&lt;/P&gt;
&lt;P&gt;how I can I define the lookup without a header&amp;nbsp; or I should create a header manually&amp;nbsp; ?&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Mon, 19 Dec 2022 15:26:49 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-create-lookup-without-header/m-p/624653#M107370</guid>
      <dc:creator>rayar</dc:creator>
      <dc:date>2022-12-19T15:26:49Z</dc:date>
    </item>
    <item>
      <title>Re: Create lookup without header</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-create-lookup-without-header/m-p/624654#M107371</link>
      <description>&lt;P&gt;Hi&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/45236"&gt;@rayar&lt;/a&gt;,&lt;/P&gt;&lt;P&gt;no you have only to create your lookup and the Lookup Definition (don't forget it!) and then save the nslookup command output in it.&lt;/P&gt;&lt;P&gt;Ciao.&lt;/P&gt;&lt;P&gt;Giuseppe&lt;/P&gt;</description>
      <pubDate>Sun, 18 Dec 2022 10:30:55 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-create-lookup-without-header/m-p/624654#M107371</guid>
      <dc:creator>gcusello</dc:creator>
      <dc:date>2022-12-18T10:30:55Z</dc:date>
    </item>
    <item>
      <title>Re: Create lookup without header</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-create-lookup-without-header/m-p/624655#M107372</link>
      <description>&lt;P&gt;How I can define that the lookup doesn't have a header&amp;nbsp; and the first line is a value&amp;nbsp; ?&lt;/P&gt;</description>
      <pubDate>Sun, 18 Dec 2022 10:34:20 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-create-lookup-without-header/m-p/624655#M107372</guid>
      <dc:creator>rayar</dc:creator>
      <dc:date>2022-12-18T10:34:20Z</dc:date>
    </item>
    <item>
      <title>Re: Create lookup without header</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-create-lookup-without-header/m-p/624668#M107373</link>
      <description>&lt;P&gt;Hi&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/45236"&gt;@rayar&lt;/a&gt;,&lt;/P&gt;&lt;P&gt;how do you think to populate the lookup, using a search or a script?&lt;/P&gt;&lt;P&gt;is using a search, at the end of the search (before the outputlookup command) you'll use the table command listing all the fields that are the output of your search, this will be the header for your lookup defining the lookup fields list.&lt;/P&gt;&lt;P&gt;Ciao.&lt;/P&gt;&lt;P&gt;Giuseppe&lt;/P&gt;</description>
      <pubDate>Sun, 18 Dec 2022 16:40:38 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-create-lookup-without-header/m-p/624668#M107373</guid>
      <dc:creator>gcusello</dc:creator>
      <dc:date>2022-12-18T16:40:38Z</dc:date>
    </item>
  </channel>
</rss>

