Getting Data In

csv lookup on aliased field

EricPartington
Communicator

I am trying to setup a csv lookup for data enrichment on an Aliased field. original field name dstport aliased to dest_port (common info model name)

what field will work for the data lookup?

lookup_table = ProtocolLookup dstport OUTPUT app

or

lookup_table = ProtocolLookup dest_port OUTPUT app

with the CSV column name reflecting either dest_port or dstport

0 Karma
1 Solution

Lowell
Super Champion

I believe that field aliasing happens before lookups. So I would go with the common information model field names. If push come to shove, you can always use the "as" clause in your lookup, like:

lookup_table = ProtocolLookup dest_port as dstport OUTPUT app

View solution in original post

0 Karma

Lowell
Super Champion

I believe that field aliasing happens before lookups. So I would go with the common information model field names. If push come to shove, you can always use the "as" clause in your lookup, like:

lookup_table = ProtocolLookup dest_port as dstport OUTPUT app
0 Karma

EricPartington
Communicator

thanks, original port works fine as the base for this CSV enrichment.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...