Splunk Search

Does multikv work with lookup tables?

Splunk Employee
Splunk Employee

I am using multikv and want to use a lookup table against some of the fields extracted form multikv. How can I get the lookups to work with multikv? My example search is:

source=top | multikv

Splunk Employee
Splunk Employee

The multikv command is likely occurring prior to the lookup. Therefore, you can manually specify the lookup to occur after the multikv:

source=top | multikv | lookup
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!