Splunk Search

Does multikv work with lookup tables?

Simeon
Splunk Employee
Splunk Employee

I am using multikv and want to use a lookup table against some of the fields extracted form multikv. How can I get the lookups to work with multikv? My example search is:

source=top | multikv

Simeon
Splunk Employee
Splunk Employee

The multikv command is likely occurring prior to the lookup. Therefore, you can manually specify the lookup to occur after the multikv:

source=top | multikv | lookup
Get Updates on the Splunk Community!

Splunk Search APIを使えば調査過程が残せます

   このゲストブログは、JCOM株式会社の情報セキュリティ本部・専任部長である渡辺慎太郎氏によって執筆されました。 Note: This article is published in both Japanese ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...