topic lookup query in Splunk Search

lookup query

pacifikn — Wed, 11 Dec 2019 10:18:16 GMT

Greetings!!

I have created a new lookup table xyz.csv that contain host and hostname(as description) and the name of lookup is xyz_lookup

when i search |inputlookup xyz_lookup I got the table with host and hostname,

BUT my question is:
what query can I use to combine the other command with this lookup,

when I search for index= xx sourcetype=ttt |top host -this gives me host,count,percent BUT i want also to use that it gives me also hostname , not only host ...

Help me on how I could combine my lookup with other query? Thank you in advance

regards
paci N

Re: lookup query

raduurjan — Wed, 11 Dec 2019 10:36:56 GMT

Hello!

You can try to output your inputlookup results (since inputlookup should be the first item in your search) with the MAP command to combine results.

You can find more info about this in the following posts:

https://docs.splunk.com/Documentation/SplunkCloud/8.0.0/SearchReference/Map
https://answers.splunk.com/answers/743935/problem-with-map-command-using-search-from-lookup.html

Re: lookup query

to4kawa — Wed, 11 Dec 2019 11:48:53 GMT

index= xx sourcetype=ttt 
|top host
|lookup xyz_lookup

Hi, @pacifikn
how is it?

Re: lookup query

pacifikn — Thu, 12 Dec 2019 06:27:00 GMT

Thank you All for your quick response,

I didn't tell soon , I have tried to use OUTPUTNEW and it is working correctly,

index=xxx sourrcetype=tttt action=T |top host |lookup name_lookup host OUTPUTNEW hostname

I used the above command and it was working correctly.

Thank you again for the other way you mentioned above it is also working good! thank you all

Re: lookup query

pacifikn — Thu, 12 Dec 2019 06:47:42 GMT

Dear to4kawa ,

now it is working good , but when I saw the command you wrote, it looks the same with the one I used but I added the name of the firstColumn OUTPUTNEW secondColumn(description of the first column)

like this:
index= xx sourcetype=ttt
|top host
|lookup xyz_lookup host OUTPUTNEW hostname(Desc)