topic Re: Outputlookup followed by stats command causes extra column to be generated in Splunk Search

Outputlookup followed by stats command causes extra column to be generated

Anders333 — Fri, 14 Nov 2025 13:29:26 GMT

Hello, I came across some unexpected search behaviour today.

When using the outputlookup command followed by a stats command, as in the example, an additional empty column is added to the lookup file.

| makeresults | eval test = "this is a testing thing" | outputlookup append=false testindjiasbhd8a0.csv | stats values(test) as testing

Expected lookup table:

_time	test
2025-11-14 14:19:07	this is a testing thing

Actual lookup table:

_time	test	testing
2025-11-14 14:19:07	this is a testing thing

I don't know if this is a bug or expected behaviour., and I was unable to find anything that would explain it.

Thanks 🙂

Re: Outputlookup followed by stats command causes extra column to be generated

ITWhisperer — Fri, 14 Nov 2025 23:18:59 GMT

My understanding is that as part of the search processing, the processor determines which fields are required at the end and those are then available to be output by the outputlookup command. It doesn't have to be a stats command or even a field with any values. For example, a similar result will be shown if you try this:

| makeresults | eval test = "this is a testing thing" | outputlookup append=false testindjiasbhd8a0.csv | table testing

However, you can work around this by removing the field before it is created

Re: Outputlookup followed by stats command causes extra column to be generated

PrewinThomas — Mon, 17 Nov 2025 04:44:32 GMT

@Anders333

The lookup file is created with the fields _time and test, then you run stats values(test) as testing. This produces a new field testing in the search results.
Splunk lookup files are schema‑flexible. If later commands introduce new fields, splunk adds them as new columns, even if they’re empty for existing rows.

If you need only testing field then write your outputlookup command after your stats.
Eg:

| makeresults | eval test = "this is a testing thing" | stats values(test) as testing | outputlookup append=false test.csv

Regards,
Prewin
🌟If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!