Splunk Search

How to prepend entry in lookup

saurabhatsplunk
New Member

Hi All,

I want to add entry on first row of my lookup. I know how to append the entry using outputlookup but is there any way to prepend the entry on first row in lookup?


Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @saurabhatsplunk ,

the order is the one you have in your result list before the outputlookup command ,

so, the correct questiojn is: how to add a the first position in the result list?

if you coult share your search I could help you.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Detecting Brute Force Account Takeover Fraud with Splunk

This article is the second in a three-part series exploring advanced fraud detection techniques using Splunk. ...

Buttercup Games: Further Dashboarding Techniques (Part 9)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Buttercup Games: Further Dashboarding Techniques (Part 8)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...