https://community.splunk.com/t5/Splunk-Search/How-to-use-an-index-for-a-lookup/m-p/368136#M162125 <P>Noob question.</P> <P>I had about a dozen CSVs that had the same information on them but the columns were out of order. I imported them all into a new index and splunk sorted it out no problem. The information on the tables is for the most part static and I would like to use the lookup command and automatic lookups to enrich other indexes with the information in the new index. Is this possible or do I need to export the index as a csv and re-upload it as a lookup table?</P> Tue, 20 Mar 2018 12:46:46 GMT subhuman 2018-03-20T12:46:46Z https://community.splunk.com/t5/Splunk-Search/How-to-use-an-index-for-a-lookup/m-p/368136#M162125 <P>Noob question.</P> <P>I had about a dozen CSVs that had the same information on them but the columns were out of order. I imported them all into a new index and splunk sorted it out no problem. The information on the tables is for the most part static and I would like to use the lookup command and automatic lookups to enrich other indexes with the information in the new index. Is this possible or do I need to export the index as a csv and re-upload it as a lookup table?</P> Tue, 20 Mar 2018 12:46:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-an-index-for-a-lookup/m-p/368136#M162125 subhuman 2018-03-20T12:46:46Z https://community.splunk.com/t5/Splunk-Search/How-to-use-an-index-for-a-lookup/m-p/368137#M162126 <P>Hi There,</P> <P>You could quite possibly be looking for the inputlookup and outputlookup commands, if you were to write a search using the index that has your csv data in then you could use the above commands to essentially create a new lookup file to be used elsewhere as an automatic lookup</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Outputlookup">https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Outputlookup</A></P> Tue, 20 Mar 2018 15:02:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-an-index-for-a-lookup/m-p/368137#M162126 paulbannister 2018-03-20T15:02:36Z https://community.splunk.com/t5/Splunk-Search/How-to-use-an-index-for-a-lookup/m-p/368138#M162127 <P>Well one of the option is definitely outputlookup your current "index made of lookups" and the use the <STRONG>lookup</STRONG> command to enrich other data with it.</P> <P>If you really want to stick with the index format, I'd suggest you to take a look at the join command:</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Join">https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Join</A></P> Tue, 20 Mar 2018 15:18:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-an-index-for-a-lookup/m-p/368138#M162127 tiagofbmm 2018-03-20T15:18:51Z https://community.splunk.com/t5/Splunk-Search/How-to-use-an-index-for-a-lookup/m-p/368139#M162128 <P>Please let me know if the answer was useful for you. If it was, accept it and upvote. If not, give us more input so we can help you with that</P> Wed, 21 Mar 2018 17:29:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-an-index-for-a-lookup/m-p/368139#M162128 tiagofbmm 2018-03-21T17:29:38Z