https://community.splunk.com/t5/Splunk-Search/lookup-based-on-2-fields-not-working/m-p/106456#M27678 <P>i have created a lookup.csv file as below and uploaded the file.<BR /> then i have created lookup definition with this particular file.<BR /> then i have created a automatic lookup where the lookup input fields are hostname and technology and the lookup output fields is gold.</P> <P>Gold.csv<BR /> technology hostname gold<BR /> OS stc08a00 sts08a00<BR /> OS std08a00 sts08a00<BR /> OS std08a01 sts08a00<BR /> OS sts08a00 sts08a00<BR /> SAP stc08a00 sts08a00<BR /> SAP std08a00 sts08a00<BR /> SAP std08a01 sts08a00<BR /> SAP sts08a00 sts08a00</P> <P>now when i write a search to get the gold of SAP, its not returning any gold value but when i search for OS it works.<BR /> query and results:<BR /> index="abc" technology=OS | table hostname,gold<BR /> host gold<BR /> 1 std08a01 sts08a00<BR /> 2 stc08a00 sts08a00<BR /> 3 std08a01 sts08a00<BR /> 4 stc08a00 sts08a00<BR /> 5 std08a00 sts08a00<BR /> 6 sts08a00<BR /><BR /> 7 std08a00 sts08a00<BR /> 8 sts08a00<BR /><BR /> index="abc" technology=SAP| table hostname,gold</P> <PRE><CODE>host gold </CODE></PRE> <P>1 std08a01<BR /><BR /> 2 stc08a00<BR /><BR /> 3 std08a00<BR /><BR /> 4 stc08a00<BR /><BR /> 5 sts08a00<BR /><BR /> 6 std08a00<BR /><BR /> 7 std08a01<BR /><BR /> 8 sts08a00 </P> <P>please let me know where i am going wrong. doesnt lookup work when we use 2 fields as input?</P> Fri, 18 Oct 2013 18:46:19 GMT spyme72 2013-10-18T18:46:19Z https://community.splunk.com/t5/Splunk-Search/lookup-based-on-2-fields-not-working/m-p/106456#M27678 <P>i have created a lookup.csv file as below and uploaded the file.<BR /> then i have created lookup definition with this particular file.<BR /> then i have created a automatic lookup where the lookup input fields are hostname and technology and the lookup output fields is gold.</P> <P>Gold.csv<BR /> technology hostname gold<BR /> OS stc08a00 sts08a00<BR /> OS std08a00 sts08a00<BR /> OS std08a01 sts08a00<BR /> OS sts08a00 sts08a00<BR /> SAP stc08a00 sts08a00<BR /> SAP std08a00 sts08a00<BR /> SAP std08a01 sts08a00<BR /> SAP sts08a00 sts08a00</P> <P>now when i write a search to get the gold of SAP, its not returning any gold value but when i search for OS it works.<BR /> query and results:<BR /> index="abc" technology=OS | table hostname,gold<BR /> host gold<BR /> 1 std08a01 sts08a00<BR /> 2 stc08a00 sts08a00<BR /> 3 std08a01 sts08a00<BR /> 4 stc08a00 sts08a00<BR /> 5 std08a00 sts08a00<BR /> 6 sts08a00<BR /><BR /> 7 std08a00 sts08a00<BR /> 8 sts08a00<BR /><BR /> index="abc" technology=SAP| table hostname,gold</P> <PRE><CODE>host gold </CODE></PRE> <P>1 std08a01<BR /><BR /> 2 stc08a00<BR /><BR /> 3 std08a00<BR /><BR /> 4 stc08a00<BR /><BR /> 5 sts08a00<BR /><BR /> 6 std08a00<BR /><BR /> 7 std08a01<BR /><BR /> 8 sts08a00 </P> <P>please let me know where i am going wrong. doesnt lookup work when we use 2 fields as input?</P> Fri, 18 Oct 2013 18:46:19 GMT https://community.splunk.com/t5/Splunk-Search/lookup-based-on-2-fields-not-working/m-p/106456#M27678 spyme72 2013-10-18T18:46:19Z https://community.splunk.com/t5/Splunk-Search/lookup-based-on-2-fields-not-working/m-p/106457#M27679 <P>it worked, the issue was in the data where i had the field name as host instead of hostname. fixing that fixed the lookup</P> Fri, 18 Oct 2013 20:44:39 GMT https://community.splunk.com/t5/Splunk-Search/lookup-based-on-2-fields-not-working/m-p/106457#M27679 spyme72 2013-10-18T20:44:39Z