topic Re: In a CSV lookup, is the first column always the input ? in Splunk Search

In a CSV lookup, is the first column always the input ?

dxw350 — Fri, 16 Jun 2017 15:27:57 GMT

In Vlookup for excel, the input is always the first column on the left. In Splunk, is this required? I am having difficulty adding the csv file with additional fields that I want to incorporate into my Splunk queries for results.

Re: In a CSV lookup, is the first column always the input ?

woodcock — Fri, 16 Jun 2017 15:47:42 GMT

No, you specify the input field like this:

... | lookup YourLookupDefinition YourInputField OUTPUT Your Output Fields Here

Re: In a CSV lookup, is the first column always the input ?

gcusello — Fri, 16 Jun 2017 15:50:58 GMT

Hi dxw350,
what do you mean with "the input is always the first column on the left"?
In Splunk you can load a csv as a lookup or manually create a lookup using Lookup Editor App, there isn't any order or key, you can use every column as key in your searches.
You have only to create a lookup (I suggest to use Lookup Editor App) and then use it.
See at http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsfromexternaldatasources how to use lookups.
Bye.
Giuseppe