All Apps and Add-ons

lookup multiple inputs

chvnc
Explorer

Hi,

one field has two values while use multiple input field within a lookup command and not getting the output.
The lookuptable looks like this:

env id file

eservices 123 abc123
xyz 456 abc456

I tried it like this, but it didn't work:

passing the env and id values in query and then
| lookup lookup.csv env,id OUTPUT file

if I pass only env=xyz its working but if two values are passed its not working.

0 Karma

sundareshr
Legend

Try this

.... | eval env_id=env." ".id | lookup "env id" AS env_id OUTPUT file
0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...