topic Re: lookup usage in query in Splunk Search

lookup usage in query

sahana — Tue, 30 Nov 2021 05:45:54 GMT

Hi,

I have a requirement like we have a csv file which has the values of functionid and functiondesc, this file was added in lookup also. I get a value eventid from the logs which is same as functionid. Now, we need to fetch the functiondesc of the corresponding eventid. and display it in table.

Re: lookup usage in query

ITWhisperer — Tue, 30 Nov 2021 07:37:21 GMT

| lookup csv_store functionid as eventid

Re: lookup usage in query

sahana — Tue, 30 Nov 2021 08:06:56 GMT

I was suppose to get functiondesc value using eventid?

Re: lookup usage in query

ITWhisperer — Tue, 30 Nov 2021 08:18:06 GMT

That's how the lookup command work (you can alias the field name from the event to be the same as the field name from the lookup)

lookup

Description

Use the lookup command to invoke field value lookups.

For information about the types of lookups you can define, see About lookups in the Knowledge Manager Manual.

Syntax

The required syntax is in bold.

lookup [local=<bool>] [update=<bool>] <lookup-table-name> ( <lookup-field> [AS <event-field>] )... [ OUTPUT | OUTPUTNEW (<lookup-destfield> [AS <event-destfield>] )... ] https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Lookup