lookup data not population in final part of query

vk1544 — Tue, 07 Nov 2023 22:33:23 GMT

Hi all

i have the below query where i have a lookup file with Error messages im trying to match the error messages in the lookup and then matching those in the rawdata and showing in table. However my final result query field is coming as empty rest all are populating. Need help in the query i was trying to add before the table command | lookup ErrorMessage.csv query OUTPUT query but not working need help

index=abc host="LINUX123" " source="/new/dir/apps/servers/service*.log" "Error data*" [ | inputlookup ErrorMessage.csv | fields + ErrorMessage | rename ErrorMessage as query] | table _time,host,query, _raw

lookup file content

ErrorMessage.csv

File Not Found

Error data in client transacton

thanks in advance

Re: lookup data not population in final part of query

ITWhisperer — Tue, 07 Nov 2023 23:11:04 GMT

The query field (like the search field) are special cases in subqueries as they are not passed to the outer search, only their values are. This is why the final query field is empty.

topic Re: lookup data not population in final part of query in Splunk Search

lookup data not population in final part of query

Re: lookup data not population in final part of query