topic Re: lookups via powershell resource kit in Splunk Search https://community.splunk.com/t5/Splunk-Search/lookups-via-powershell-resource-kit/m-p/67894#M16963 <P>I hate to do this but I thought it might be worth giving this a little bump now that America is awake and at work </P> <P>I promise not to make a habit of it <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Wed, 08 Feb 2012 23:02:27 GMT Bulluk 2012-02-08T23:02:27Z lookups via powershell resource kit https://community.splunk.com/t5/Splunk-Search/lookups-via-powershell-resource-kit/m-p/67893#M16962 <P>Does anyone know if it's possible to perform a lookup when using the powershell resource kit's search functionality? I'm currently on v4.2 and saw that lookup was added to the rest api in 4.3 so I'm guessing this won't be possible yet....</P> <P>My really simple search is</P> <PRE><CODE>find something | lookup myLookup name AS userName OUTPUTNEW Title AS Title </CODE></PRE> <P>which works fine via the gui but not when using powershell</P> <P>Thanks in advance</P> Wed, 08 Feb 2012 16:12:50 GMT https://community.splunk.com/t5/Splunk-Search/lookups-via-powershell-resource-kit/m-p/67893#M16962 Bulluk 2012-02-08T16:12:50Z Re: lookups via powershell resource kit https://community.splunk.com/t5/Splunk-Search/lookups-via-powershell-resource-kit/m-p/67894#M16963 <P>I hate to do this but I thought it might be worth giving this a little bump now that America is awake and at work </P> <P>I promise not to make a habit of it <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Wed, 08 Feb 2012 23:02:27 GMT https://community.splunk.com/t5/Splunk-Search/lookups-via-powershell-resource-kit/m-p/67894#M16963 Bulluk 2012-02-08T23:02:27Z Re: lookups via powershell resource kit https://community.splunk.com/t5/Splunk-Search/lookups-via-powershell-resource-kit/m-p/67895#M16964 <P>Turns out that if you add the -RequiredField flag to the search it returns the values from the lookup, ie:</P> <PRE><CODE>$results = Search-Splunk -Search "find something `| lookup myLookup name AS userName OUTPUTNEW Title AS Title" -RequiredField "Title" </CODE></PRE> Thu, 09 Feb 2012 11:57:43 GMT https://community.splunk.com/t5/Splunk-Search/lookups-via-powershell-resource-kit/m-p/67895#M16964 Bulluk 2012-02-09T11:57:43Z