https://community.splunk.com/t5/Getting-Data-In/csv-lookup-on-aliased-field/m-p/67653#M13662 <P>I believe that field aliasing happens before lookups. So I would go with the common information model field names. If push come to shove, you can always use the "as" clause in your lookup, like:</P> <PRE><CODE>lookup_table = ProtocolLookup dest_port as dstport OUTPUT app </CODE></PRE> Sat, 09 Oct 2010 03:23:14 GMT Lowell 2010-10-09T03:23:14Z https://community.splunk.com/t5/Getting-Data-In/csv-lookup-on-aliased-field/m-p/67652#M13661 <P>I am trying to setup a csv lookup for data enrichment on an Aliased field. original field name dstport aliased to dest_port (common info model name)</P> <P>what field will work for the data lookup?</P> <PRE><CODE>lookup_table = ProtocolLookup dstport OUTPUT app </CODE></PRE> <P>or </P> <PRE><CODE>lookup_table = ProtocolLookup dest_port OUTPUT app </CODE></PRE> <P>with the CSV column name reflecting either dest_port or dstport</P> Sat, 09 Oct 2010 03:11:33 GMT https://community.splunk.com/t5/Getting-Data-In/csv-lookup-on-aliased-field/m-p/67652#M13661 EricPartington 2010-10-09T03:11:33Z https://community.splunk.com/t5/Getting-Data-In/csv-lookup-on-aliased-field/m-p/67653#M13662 <P>I believe that field aliasing happens before lookups. So I would go with the common information model field names. If push come to shove, you can always use the "as" clause in your lookup, like:</P> <PRE><CODE>lookup_table = ProtocolLookup dest_port as dstport OUTPUT app </CODE></PRE> Sat, 09 Oct 2010 03:23:14 GMT https://community.splunk.com/t5/Getting-Data-In/csv-lookup-on-aliased-field/m-p/67653#M13662 Lowell 2010-10-09T03:23:14Z https://community.splunk.com/t5/Getting-Data-In/csv-lookup-on-aliased-field/m-p/67654#M13663 <P>thanks, original port works fine as the base for this CSV enrichment.</P> Wed, 13 Oct 2010 02:13:51 GMT https://community.splunk.com/t5/Getting-Data-In/csv-lookup-on-aliased-field/m-p/67654#M13663 EricPartington 2010-10-13T02:13:51Z