topic Re: Automatic Lookup to Overwrite Field Value at Search Time in Splunk Search

Automatic Lookup to Overwrite Field Value at Search Time

agodoy — Mon, 08 Jul 2013 21:44:03 GMT

I am trying to overwrite a field that is boolean. I created a table to convert 1/0 to IN/OUT so that the data is more human readable.

Below is my props.conf entry.

[source::mysource]
LOOKUP-mylookup = lookup_table direction_inbound AS direction_inbound OUTPUT direction AS direction_inbound

I have tried:

LOOKUP-mylookup = lookup_table direction_inbound AS direction_inbound OUTPUTNEW direction AS direction_inbound

with no positive results. Transforms.conf has the path to the csv. The lookup works if I create a new field, but I want to overwrite the field that is already there.

Any idea what I might be missing.

Re: Automatic Lookup to Overwrite Field Value at Search Time

cheganbm — Thu, 08 May 2014 15:42:35 GMT

Already answered in: http://answers.splunk.com/answers/3989/overwriting-input-field-in-lookup

Re: Automatic Lookup to Overwrite Field Value at Search Time

niemesrw — Sat, 03 Dec 2016 15:33:11 GMT

Not sure when it was introduced, but you can now overwrite fields:

http://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Lookup