Splunk Enterprise

help on outputlookup field name

jip31
Motivator

hi

I use a scheduled search in order to generate a csv lookup

| inputlookup fo_all where TYPE="PC" 
| rename HOSTNAME as host 
| table host 
| outputlookup industrial_host.csv

As you can see, I identify a list of host in order to copy them in the lookup

but at the beginning of my lookyp, i need to have the name "host" and after the list of the host

how to do this please? 

Labels (1)
Tags (1)
0 Karma
1 Solution

t_shreya
Path Finder

Hi @jip31 

Your query will create the following lookup:

host
val1
val2
val3
........

Is this the way in which you require the lookup to be or some other format?

View solution in original post

0 Karma

t_shreya
Path Finder

Hi @jip31 

Your query will create the following lookup:

host
val1
val2
val3
........

Is this the way in which you require the lookup to be or some other format?

0 Karma

jip31
Motivator

Hi

OK I thought the header 'host" will not be created automatically.....

Thanks

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...