https://community.splunk.com/t5/Splunk-Search/Lookup-query-What-does-append-T-mean/m-p/119317#M32013 <P>The <CODE>append</CODE> option is part of <CODE>inputlookup</CODE>, not <CODE>lookup</CODE> - see <A href="http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/inputlookup">http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/inputlookup</A> for reference.</P> <P>There it means you can add <CODE>... | inputlookup my_lookup append=t</CODE> to the end of a search pipeline to append the data from the lookup file to the current search results. Without the <CODE>append</CODE> you can only use <CODE>inputlookup</CODE> as a generating command at the beginning of the pipeline.</P> Wed, 25 Jun 2014 09:21:23 GMT martin_mueller 2014-06-25T09:21:23Z https://community.splunk.com/t5/Splunk-Search/Lookup-query-What-does-append-T-mean/m-p/119316#M32012 <P>What does the below statement mean ?</P> <BLOCKQUOTE> <P>If 'append' is set to true (false by default), the data from the lookup file is appended to the current set of results rathering than replacing it.</P> </BLOCKQUOTE> <P>I use lookup like below,</P> <PRE><CODE>[mysearch] | lookup MyLookup field_1 as field_1 OUTPUTNEW field_2 field_3 </CODE></PRE> <P>So , with reference to field_1 value , i do obtain field_2 , field_3 ..etc</P> <P>what does that statement say, how append=t works ?</P> Mon, 28 Sep 2020 16:55:33 GMT https://community.splunk.com/t5/Splunk-Search/Lookup-query-What-does-append-T-mean/m-p/119316#M32012 splunker12er 2020-09-28T16:55:33Z https://community.splunk.com/t5/Splunk-Search/Lookup-query-What-does-append-T-mean/m-p/119317#M32013 <P>The <CODE>append</CODE> option is part of <CODE>inputlookup</CODE>, not <CODE>lookup</CODE> - see <A href="http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/inputlookup">http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/inputlookup</A> for reference.</P> <P>There it means you can add <CODE>... | inputlookup my_lookup append=t</CODE> to the end of a search pipeline to append the data from the lookup file to the current search results. Without the <CODE>append</CODE> you can only use <CODE>inputlookup</CODE> as a generating command at the beginning of the pipeline.</P> Wed, 25 Jun 2014 09:21:23 GMT https://community.splunk.com/t5/Splunk-Search/Lookup-query-What-does-append-T-mean/m-p/119317#M32013 martin_mueller 2014-06-25T09:21:23Z https://community.splunk.com/t5/Splunk-Search/Lookup-query-What-does-append-T-mean/m-p/119318#M32014 <P>How the field values in my_lookup will be appended to my current search ? I mean ,on what basis or reference ?</P> Wed, 25 Jun 2014 10:34:13 GMT https://community.splunk.com/t5/Splunk-Search/Lookup-query-What-does-append-T-mean/m-p/119318#M32014 splunker12er 2014-06-25T10:34:13Z https://community.splunk.com/t5/Splunk-Search/Lookup-query-What-does-append-T-mean/m-p/119319#M32015 <P><CODE>append=t</CODE> has nothing to do with the <CODE>lookup</CODE> command, but rather with the <CODE>inputlookup</CODE> command which does something entirely different.</P> Wed, 25 Jun 2014 11:18:21 GMT https://community.splunk.com/t5/Splunk-Search/Lookup-query-What-does-append-T-mean/m-p/119319#M32015 martin_mueller 2014-06-25T11:18:21Z