Splunk Enterprise

Limit on LOOKUP when use OUTPUT


Hi, does anyone here faces the same issue?

Below is my sample query for reference.



| makeresults
| eval statename= "Selangor"
| eval mega="state"
| lookup type.csv mega as megas OUTPUT WP_Kuala_Lumpur_list, WP_Putrajaya_list, Johor_list, Kedah_list, Kelantan_list,
Melaka_list, Negeri_Sembilan_list, Pahang_list, Perak_list, Pulau_Pinang_list, Sabah_list, Sarawak_list, Selangor_list, Terengganu_list, Perlis_list
| eval res= case(statename= "Kuala Lumpur", WP_Kuala_Lumpur_list,
statename= "Putrajaya", WP_Putrajaya_list,
statename= "Johor", Johor_list,
statename= "Kedah", Kedah_list,
statename= "Kelantan", Kelantan_list,
statename= "Melaka", Melaka_list,
statename= "Negeri Sembilan", Negeri_Sembilan_list,
statename= "Pahang", Pahang_list,
statename= "Perak", Perak_list,
statename= "Pulau Pinang", Pulau_Pinang_list,
statename= "Sabah", Sabah_list,
statename= "Sarawak", Sarawak_list,
statename= "Selangor", Selangor_list,
statename= "Terengganu", Terengganu_list,
statename= "Perlis", Perlis_list)

| table res




In the lookup, Selangor_list has more than 60 rows. But, when I ran the query it just show me 33 rows.

then, I figure out if run the query with less OUTPUT it is able to show the correct data.


May I know any limitations on this?


Labels (1)
0 Karma


Basically the more fields you will specify in the output it will first match with the lookup field and your event field if they match then that output is shown else neglected.


When using the lookup command, if an OUTPUT or OUTPUTNEW clause is not specified, all of the fields in the lookup table that are not the match field are used as output fields. If the OUTPUT clause is specified, the output lookup fields overwrite existing fields. If the OUTPUTNEW clause is specified, the lookup is not performed for events in which the output fields already exist.


Also, If this reply helps you, an upvote would be appreciated.

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...