Splunk Enterprise

help on outputlookup field name

jip31
Motivator

hi

I use a scheduled search in order to generate a csv lookup

| inputlookup fo_all where TYPE="PC" 
| rename HOSTNAME as host 
| table host 
| outputlookup industrial_host.csv

As you can see, I identify a list of host in order to copy them in the lookup

but at the beginning of my lookyp, i need to have the name "host" and after the list of the host

how to do this please? 

Labels (1)
Tags (1)
0 Karma
1 Solution

t_shreya
Path Finder

Hi @jip31 

Your query will create the following lookup:

host
val1
val2
val3
........

Is this the way in which you require the lookup to be or some other format?

View solution in original post

0 Karma

t_shreya
Path Finder

Hi @jip31 

Your query will create the following lookup:

host
val1
val2
val3
........

Is this the way in which you require the lookup to be or some other format?

0 Karma

jip31
Motivator

Hi

OK I thought the header 'host" will not be created automatically.....

Thanks

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...