topic Re: Use Lookup to Add MetaData to Results in Splunk Search

Use Lookup to Add MetaData to Results

aapittts — Mon, 25 Feb 2013 20:44:31 GMT

If I have a lookup table with ID's and descriptions, is it possible to use the lookup table to add the corresponding descriptions to the ID's in search results?

I thought this was the purpose of the lookup command but I'm not getting anywhere using it.

If I have a list of codes, how to I use a lookup table to match the codes with the descriptions and output the code and description to the search results?

Lookup:

code,desc
1234,lorem ipsum
4567,lorem ipsum

desc is not a field in my transforms.conf. Does that matter?

Re: Use Lookup to Add MetaData to Results

Ayn — Mon, 25 Feb 2013 21:19:07 GMT

That is definitely how you can use lookups. You should provide more information on your scenario and what you're trying so we can help you troubleshoot your issue.

Re: Use Lookup to Add MetaData to Results

aapittts — Fri, 01 Mar 2013 15:58:41 GMT

Hopefully this helps another newb such as myself.

Search term is: | lookup TableName LookupField as LocalField

LookupField = Field in LookupTable

LocalField = Field in Splunk