I have source data and i have inputlookup data, now i need to match them with column, but column name in source is Student and Column name in Inputlookup is Roll_Number. How can i match them?

[kdoma]

I have source data and i have inputlookup data, now i need to match them with column, but column name in source is Student and Column name in Inputlookup is Roll_Number. How can i match them?

[sideview · Accepted solution]

Manually, you can just do it in the lookup command.

<your search terms> |lookup MyLookupName Roll_Number as Student 

Or if you want to have the lookup run automatically whenever Splunk deals with these events you can either put a pretty similar looking syntax into props.conf, or what's a lot easier is to do it all in the Settings UI.

some key docs on Automatic Lookups -
https://docs.splunk.com/Documentation/Splunk/6.4.3/Knowledge/Usefieldlookupstoaddinformationtoyourev...
https://docs.splunk.com/Documentation/Splunk/6.4.3/Knowledge/Makeyourlookupautomatic

Some docs about the lookup command -
http://docs.splunk.com/Documentation/Splunk/6.4.3/SearchReference/Lookup

[kdoma]

Thank you very much, now I could match and see the results.