How to combine lookup file with splunk query, static data with live data

[san112491]

Static data with one common field app Name as splunk query.

[gcusello]

Hi @san112491,

as @yuanliu said, you have to find the correlation key between main search and lookup: if the common fields have the same name you can use something like this:

<your_search>
| lookup your_lookup.csv common field

if instead the field name to correlate are different,  you can use:

<your_search>
| lookup your_lookup.csv lookup_field AS main_search_field

For more infos I hint to read at https://docs.splunk.com/Documentation/Splunk/9.0.1/SearchReference/Lookup

Ciao.

giuseppe

[yuanliu]

Not sure what the real question is.  Assuming your static data is in the lookup file, you just define a lookup with that file, then use lookup, e.g.,

| lookup mylookup common_field

All other fields in mylookup will be populated according to match.