Turn on suggestions

Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.

Showing results for

Splunk Search

Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.

Showing results for

- Community
- :
- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How do lookups work in Splunk? Can you lookup a va...

- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page

Highlighted

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

HattrickNZ

Motivator

08-13-2015
07:49 PM

How do lookups work in Splunk?

I presume it works like this, `lookupA`

is the value you are looking for and `ValueToReplaceLookup`

is the value that is returned.

```
lookupA,ValueToReplaceLookup
A,America
B,Beijing
C,Columbia
```

But can it also work this way; looking up a value and the value is returned is to the left of it. E.g. `lookupA`

is the value you are looking for and `ValueToReplaceLookup`

is the value that is returned, but `ValueToReplaceLookup`

will be on the left as opposed to the right?

```
ValueToReplaceLookup,lookupA,
America,A
Beijing,B
Columbia,C
```

Just wondering if I should be formatting my data accordingly before uploading it to Splunk for doing lookups.

1 Solution

Highlighted
##
Re: How do lookups work in Splunk? Can you lookup a value and use the corresponding value to its left and vice versa?

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

gpradeepkumarre

Influencer

08-13-2015
08:48 PM

You don't have to format it. Column position does not matter.

Highlighted

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

jeffland

Champion

08-13-2015
10:47 PM

Luckily, Splunk is not Excel. Lookups work per line, not from left to right, so the order of colums doesn't matter at all.

Did you know you can also lookup more than one value? And that you can write your own .csv file from splunk with one search and look stuff up there with another search? Lookup in Splunk is actually fun! 🙂

Highlighted
##
Re: How do lookups work in Splunk? Can you lookup a value and use the corresponding value to its left and vice versa?

tks, good to know, now I just need to find examples where I can use that them other ways you mention of using lookups

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

HattrickNZ

Motivator

08-16-2015
02:09 PM

Highlighted
##
Re: How do lookups work in Splunk? Can you lookup a value and use the corresponding value to its left and vice versa?

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

HattrickNZ

Motivator

08-16-2015
06:45 PM

this here might be an example of how I can apply lookups further mentioned above?

Speak Up for Splunk Careers!

Career Survey Now!