topic Lookup multiple values in Splunk Search

Lookup multiple values

edschembor — Mon, 30 Jun 2014 21:00:10 GMT

So I'm doing a lookup for multiple values, so similar to the following:

...| lookup entity OUTPUT x as XX y as YY

How can I do this with multiple values. Like instead would it be:

...| lookup entity OUTPUT x as XX AND y as YY

However I have tried both and neither has worked. Any ideas? Thanks!!!

Re: Lookup multiple values

martin_mueller — Mon, 30 Jun 2014 22:54:03 GMT

You can list as many lookup and output fields as you like:

... | lookup <lookup-table-name> <lookup-field1> AS <local-field1>, <lookup-field2> AS <local-field2> OUTPUT <lookup-destfield1> AS <local-destfield1>, <lookup-destfield2> AS <local-destfield2>

No need to link them with AND.

Re: Lookup multiple values

edschembor — Mon, 28 Sep 2020 16:58:23 GMT

This doesnt work. I get: "Error in 'lookup' command: Could not find all of the specified destination fields in the lookup table."

My lookup now looks like:

| lookup local=1 XXX_Lookup_2 EntityKey OUTPUT Paymenttransactionkey as Paymenttranstemp, EntityKey OUTPUT DISPLAYTRANSACTIONID as OPICTemp

Re: Lookup multiple values

somesoni2 — Mon, 28 Sep 2020 16:58:26 GMT

You don't need the second "EntityKey OUTPUT" thing. This should work just fine. (see the syntax mentioned in @martin's answer.

| lookup local=1 XXX_Lookup_2 EntityKey OUTPUT Paymenttransactionkey as Paymenttranstemp, DISPLAYTRANSACTIONID as OPICTemp

Re: Lookup multiple values

edschembor — Tue, 01 Jul 2014 14:53:00 GMT

Thank you!!!

Re: Lookup multiple values

srujan9292 — Wed, 05 Jul 2017 19:45:22 GMT

Hi martin_mueller,

What should be the query if we need to perform the search on same local-field?

lookup lookup-table-name lookup-field1 AS local-field1, lookup-field2 AS local-field1
OUTPUT lookup-field1, lookup-field2, lookup-field3

Here lookup-field3 is corresponding field in lookup table.
I have tried the above format, but it says no results found!!

Thanks in advance.