Splunk Enterprise

help on outputlookup field name

jip31
Motivator

hi

I use a scheduled search in order to generate a csv lookup

| inputlookup fo_all where TYPE="PC" 
| rename HOSTNAME as host 
| table host 
| outputlookup industrial_host.csv

As you can see, I identify a list of host in order to copy them in the lookup

but at the beginning of my lookyp, i need to have the name "host" and after the list of the host

how to do this please? 

Labels (1)
Tags (1)
0 Karma
1 Solution

t_shreya
Path Finder

Hi @jip31 

Your query will create the following lookup:

host
val1
val2
val3
........

Is this the way in which you require the lookup to be or some other format?

View solution in original post

0 Karma

t_shreya
Path Finder

Hi @jip31 

Your query will create the following lookup:

host
val1
val2
val3
........

Is this the way in which you require the lookup to be or some other format?

0 Karma

jip31
Motivator

Hi

OK I thought the header 'host" will not be created automatically.....

Thanks

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...