I've got a search that I'm working on. I've been asked to integrate the results of a lookup table into that search.
The major problem is that the lookup file's data, while it shares common fields with the Splunk search, doesn't have the same dataset. The search and the lookup identify two different set of results.
Is there a way to simply add all the data in the lookup to the Splunk search so that when I run the search I see both data sets?
in general you can add the lookup records to the search results only using the append command (https://docs.splunk.com/Documentation/Splunk/9.0.4/SearchReference/Append) but the effectiveness of this approach depends on your datasets (both search and lookup), on the fields you have and on the values of the common fields.
Could you share your search, a sample of results and the fields and values of your lookup?
in general you can add the lookup records to the search results only using the append command (https://docs.splunk.com/Documentation/Splunk/9.0.4/SearchReference/Append) but the effectiveness of this approach depends on your datasets (both search and lookup), on the fields you have and on the values of the common fields.
Could you share your search, a sample of results and the fields and values of your lookup?
