https://community.splunk.com/t5/Splunk-Search/Overwriting-input-field-in-lookup/m-p/16090#M2103 <P>I have a question regarding lookup tables. I want to create a lookup that places the output in the same field as the input. </P> <P>Let's say I have the following lookup table defined:<BR /> num,name<BR /> 80,http<BR /> 25,smtp </P> <P>And the search returns a field named src_port with a value of 80.</P> <P>I want a search that replaces the content of src_port with http. If the lookup doesn't produce any results then the original contents should remain.</P> <P>This is what I've tried but it doesn't work. The result is that the field src_port is not available at all. | lookup convert-portnum num AS src_port OUTPUT name AS src_port </P> <P>However, the same search using a different output field produces the expected result. | lookup convert-portnum num AS src_port OUTPUT name AS src_port_name</P> <P>Has anyone gotten something like this to work?</P> <P>Thanks</P> Thu, 24 Jun 2010 22:04:45 GMT izzy 2010-06-24T22:04:45Z https://community.splunk.com/t5/Splunk-Search/Overwriting-input-field-in-lookup/m-p/16090#M2103 <P>I have a question regarding lookup tables. I want to create a lookup that places the output in the same field as the input. </P> <P>Let's say I have the following lookup table defined:<BR /> num,name<BR /> 80,http<BR /> 25,smtp </P> <P>And the search returns a field named src_port with a value of 80.</P> <P>I want a search that replaces the content of src_port with http. If the lookup doesn't produce any results then the original contents should remain.</P> <P>This is what I've tried but it doesn't work. The result is that the field src_port is not available at all. | lookup convert-portnum num AS src_port OUTPUT name AS src_port </P> <P>However, the same search using a different output field produces the expected result. | lookup convert-portnum num AS src_port OUTPUT name AS src_port_name</P> <P>Has anyone gotten something like this to work?</P> <P>Thanks</P> Thu, 24 Jun 2010 22:04:45 GMT https://community.splunk.com/t5/Splunk-Search/Overwriting-input-field-in-lookup/m-p/16090#M2103 izzy 2010-06-24T22:04:45Z https://community.splunk.com/t5/Splunk-Search/Overwriting-input-field-in-lookup/m-p/16091#M2104 <P>It is not possible to do this. You can rename or eval the field after the lookup instead.</P> Thu, 24 Jun 2010 22:07:17 GMT https://community.splunk.com/t5/Splunk-Search/Overwriting-input-field-in-lookup/m-p/16091#M2104 gkanapathy 2010-06-24T22:07:17Z https://community.splunk.com/t5/Splunk-Search/Overwriting-input-field-in-lookup/m-p/16092#M2105 <P>oh well, it would have been nice<BR /> thanks for the reply</P> Thu, 24 Jun 2010 22:14:10 GMT https://community.splunk.com/t5/Splunk-Search/Overwriting-input-field-in-lookup/m-p/16092#M2105 izzy 2010-06-24T22:14:10Z https://community.splunk.com/t5/Splunk-Search/Overwriting-input-field-in-lookup/m-p/16093#M2106 <P>Not sure when it was introduced, but you can now overwrite with a lookup:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Lookup">http://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Lookup</A></P> Sat, 03 Dec 2016 15:33:40 GMT https://community.splunk.com/t5/Splunk-Search/Overwriting-input-field-in-lookup/m-p/16093#M2106 niemesrw 2016-12-03T15:33:40Z