Splunk Search

Are transitive lookups supported?

Splunk Employee
Splunk Employee

I am looking to take the results of one lookup and use that as input to another lookup for the same data source. Is this possible? In testing with Splunk 4.1 I was not able to get it working, but perhaps I missed something in the config. Here's what I attempted:

[mydatasource]
LOOKUP-ac1 = AreaCodeToCityLookup areacode OUTPUT city
LOOKUP-ac2 = CityToCoordinatesLookup city OUTPUT latitude, longitude

Both lookups are simple CSV lookups.

Tags (1)
1 Solution

Splunk Employee
Splunk Employee

I don't think this is possible because of the way that lookups are evaluated, but Dr. Z or Sorkin might know better.

In any case, I would recommend that the lookups be combined or that you invoke the second lookup in a search.

View solution in original post

Splunk Employee
Splunk Employee

I don't think this is possible because of the way that lookups are evaluated, but Dr. Z or Sorkin might know better.

In any case, I would recommend that the lookups be combined or that you invoke the second lookup in a search.

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!