I'm relatively new to Splunk, so if this is a stupid question, mea culpa. That being said, I have a solid SQL background and I'm in need of a solution for this seemingly easy problem. I have indexed data and I would like to link it to a lookup. The purpose of this lookup is both to limit the final output, as well as enrich the final output with some extra fields. The key for linking the lookup with the indexed data, consists of multiple fields. I was thinking about something like this:
index=ringelingdong sourcetype=ring | eval testfield=strftime(_time,'%Y%m%d%T')."#".some_id | where testfield=[| inputlookup lookup_csv.csv | eval LKPFIELD=strftime(_time,'%Y%m%d%T')."#".my_lkp_id | where checked!=0 | fields checked, changerequest | rename checked as ck, changerequest as CR] | table _time some_id ck CR
This is what I came up with so far, but I'm still missing:
Many thanks in advance
| lookup your_lookup host as host host as hostname OUTPUTNEW
now , you don't display sample logs and lookup detail. no one resolve the issue.
Whenever you have a problem with a query containing a subsearch, try running the subsearch by itself with
| format added to it. That will tell you want is being returned to the main search. Then you can verify the field names match those expected by the main search and the format is correct.