topic Re: Lookup multiple values for one field in Splunk Search

Lookup multiple values for one field

gauldridge — Tue, 05 Mar 2013 13:40:24 GMT

My lookup table contains two columns: one for the input field and one for the value which will be populated into the new field created by my lookup.

If the lookup table does not contain unique values in the input field column, how can I get every matching value from the "value" coulmn.

My thinking was that the "Maximum matches" field in "Advanced Options" under the "Lookup Definition" menu would allow more than one value to be returned for a specific input field. If so, how are the values returned? If not, how can I get all the values in the lookup table that correspond to the input field?

Re: Lookup multiple values for one field

lguinn2 — Tue, 05 Mar 2013 14:39:34 GMT

You should try it and look at the results. Yes, Splunk will return more than 1 match. If there are multiple matches, the output fields are created as multi-valued fields.

There are a variety of commands and functions within Splunk that can manipulate multi-valued fields. The eval command has a number of useful functions.

Re: Lookup multiple values for one field

gauldridge — Sun, 10 Mar 2013 05:02:07 GMT

Thanks. I didn't realize I was actually getting all of the values returned. I was expecting something like key=value1,value2,value3 not key=value1, key=value2, key=value3. I hadn't messed with multi-value fields before this.