Are transitive lookups supported?

[hulahoop]

I am looking to take the results of one lookup and use that as input to another lookup for the same data source. Is this possible? In testing with Splunk 4.1 I was not able to get it working, but perhaps I missed something in the config. Here's what I attempted:

[mydatasource]
LOOKUP-ac1 = AreaCodeToCityLookup areacode OUTPUT city
LOOKUP-ac2 = CityToCoordinatesLookup city OUTPUT latitude, longitude

Both lookups are simple CSV lookups.

[araitz · Accepted solution]

I don't think this is possible because of the way that lookups are evaluated, but Dr. Z or Sorkin might know better.

In any case, I would recommend that the lookups be combined or that you invoke the second lookup in a search.