rename field name in lookup table with outputlookup command

[newsplunker2024]

Hi,

I want to rename the fields while writing to a lookup table using outputlookup command. Is there a way to do it?

I intend to use the lookup table in the next run of the same query so want separate field names in lookup table.

Thanks in advance for the suggestions.

[ITWhisperer · Accepted solution]

Why can't you just rename it before the outputlookup and rename it back afterwards?

Please expand on your usecase

[newsplunker2024]

Yeah, that is an option as well. However, thought it would be easier if there was an option to rename the fields while writing to the lookup table.

I did an AI search which showed outputlookup had a rename option, but couldn't find it in the syntax on splunk website. So was just curious as well, if it is possible at all.

[ITWhisperer]

Yes, AI can be good at making stuff up! 😀