Splunk Search

How can I append additional custom values to existing field values obtained from an inputlookup?

tehale
New Member

I have an inputlookup xy.csv which is used by multiple searches and has comma separated data. In one of my searches, I want to append a custom value of my desire say "abc" to one of fields (say myfield ) obtained from an inputlookup, keeping all the existing values. More specifically, myfield should have values as myfield=myfield and "abc". I do not want "abc" to be appended at the end of each field value, but I want 'abc' to be a value itself so I can use it furthur for dnslookup by appending domain details.

0 Karma

wpreston
Motivator

One way would be to eval your custom value ("abc") along with a delimiting character (like a comma) onto whichever field you want it to became a value of, then use makemv to make your field into a multi-value field and split the new value into two separate values of the field. Something like this:

... your base search ... | myfield=myfield.",abc" | makemv myfield delim=","

The . in the eval is just a way of concatenating the values of myfield and ",abc" together. Try this out and see if it accomplishes what you need.

Get Updates on the Splunk Community!

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

What's New in Splunk Observability - July 2025

What’s New?  We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what ...