All Apps and Add-ons

How to read data from lookup file?

sbimizry
Engager

Hi, how to read data from the lookup file (.csv) using command lookup?
Lookup example:
FIELDS
field1
field2
field3
I try it: lookup file.csv FIELDS OUTPUT FIELDS AS newfield | table newfield but this not work, how I must write this search?
Thanks

0 Karma
1 Solution

woodcock
Esteemed Legend

The lookup command does not read data from a file, it correlates data. You have to have a field in your event whose values match the values of a field inside the lookup file. To truly read data from a lookup file, you use inputlookup like this:

| inputlookup <Your Lookup File Here>

View solution in original post

woodcock
Esteemed Legend

The lookup command does not read data from a file, it correlates data. You have to have a field in your event whose values match the values of a field inside the lookup file. To truly read data from a lookup file, you use inputlookup like this:

| inputlookup <Your Lookup File Here>
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...