Splunk Enterprise

help on outputlookup field name

jip31
Motivator

hi

I use a scheduled search in order to generate a csv lookup

| inputlookup fo_all where TYPE="PC" 
| rename HOSTNAME as host 
| table host 
| outputlookup industrial_host.csv

As you can see, I identify a list of host in order to copy them in the lookup

but at the beginning of my lookyp, i need to have the name "host" and after the list of the host

how to do this please? 

Tags (1)
0 Karma
1 Solution

t_shreya
Path Finder

Hi @jip31 

Your query will create the following lookup:

host
val1
val2
val3
........

Is this the way in which you require the lookup to be or some other format?

View solution in original post

0 Karma

t_shreya
Path Finder

Hi @jip31 

Your query will create the following lookup:

host
val1
val2
val3
........

Is this the way in which you require the lookup to be or some other format?

0 Karma

jip31
Motivator

Hi

OK I thought the header 'host" will not be created automatically.....

Thanks

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...