Splunk Search

How to create Splunk lookup query?

phularah
Communicator

I have a lookup test_lookup with 2 fields a1 and b1. The field a1 is common with the fields in the raw data.
the values of field a1 and b1 are as follows:
a1   a2 

a       1   

a        2

b        3

b        4

What would be the o/p of the command ....| lookup test_lookup a1 OUTPUT a2?

Labels (2)
Tags (1)
0 Karma

phularah
Communicator

hmm, I was asked this question in the Splunk interview today and was confused. So, the search would give an error or search won't work? 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @phularah,

usually you don't have any result in the OUTPUTTED fields when a key is duplicated, instead you should have the correlation for unique keys.

In your example youshuldn't have any value for a2 because a1 are both duplicated, if you have only one "c" value dor a1, you should have the related a2 value.

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @phularah,

yes this is the correct syntax, but the problem is that you have more than one value for a1, so the lookup command doesn't know which value must be associated.

You should use a unique value field as key.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...