Splunk Search
Highlighted

How do lookups work in Splunk? Can you lookup a value and use the corresponding value to its left and vice versa?

Motivator

How do lookups work in Splunk?

I presume it works like this, lookupA is the value you are looking for and ValueToReplaceLookup is the value that is returned.

lookupA,ValueToReplaceLookup
A,America
B,Beijing
C,Columbia

But can it also work this way; looking up a value and the value is returned is to the left of it. E.g. lookupA is the value you are looking for and ValueToReplaceLookup is the value that is returned, but ValueToReplaceLookup will be on the left as opposed to the right?

ValueToReplaceLookup,lookupA,
America,A
Beijing,B
Columbia,C

Just wondering if I should be formatting my data accordingly before uploading it to Splunk for doing lookups.

Tags (1)
0 Karma
Highlighted

Re: How do lookups work in Splunk? Can you lookup a value and use the corresponding value to its left and vice versa?

Influencer

You don't have to format it. Column position does not matter.

0 Karma
Highlighted

Re: How do lookups work in Splunk? Can you lookup a value and use the corresponding value to its left and vice versa?

Champion

Luckily, Splunk is not Excel. Lookups work per line, not from left to right, so the order of colums doesn't matter at all.

Did you know you can also lookup more than one value? And that you can write your own .csv file from splunk with one search and look stuff up there with another search? Lookup in Splunk is actually fun! 🙂

View solution in original post

Highlighted

Re: How do lookups work in Splunk? Can you lookup a value and use the corresponding value to its left and vice versa?

Motivator

tks, good to know, now I just need to find examples where I can use that them other ways you mention of using lookups

0 Karma
Highlighted

Re: How do lookups work in Splunk? Can you lookup a value and use the corresponding value to its left and vice versa?

Motivator

this here might be an example of how I can apply lookups further mentioned above?

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.