Splunk Search

How do i create another field based on existing naming convention

satya2p
Path Finder

I have a raw event from where i want to capture a few specific fields already configured in splunk and want to create a kind of lookup data which will capture a record from an existing field and outlined based on lookup instruction.

aaad00 – if d, it should be captured under data
aaan00 – if n, it should be captured under name

0 Karma

Runals
Motivator

At the highest level simply append | outputlookup my_lookup_name.csv to the end of your search. That said can you share a bit more on what it is you are trying to capture with some examples of the data or the desired state?

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...