Splunk Search

Lookup multiple values

edschembor
Path Finder

So I'm doing a lookup for multiple values, so similar to the following:

...| lookup entity OUTPUT x as XX y as YY

How can I do this with multiple values. Like instead would it be:

...| lookup entity OUTPUT x as XX AND y as YY

However I have tried both and neither has worked. Any ideas? Thanks!!!

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You can list as many lookup and output fields as you like:

... | lookup <lookup-table-name> <lookup-field1> AS <local-field1>, <lookup-field2> AS <local-field2> OUTPUT <lookup-destfield1> AS <local-destfield1>, <lookup-destfield2> AS <local-destfield2> 

No need to link them with AND.

View solution in original post

srujan9292
Explorer

Hi martin_mueller,

What should be the query if we need to perform the search on same local-field?

lookup lookup-table-name lookup-field1 AS local-field1, lookup-field2 AS local-field1
OUTPUT lookup-field1, lookup-field2, lookup-field3

Here lookup-field3 is corresponding field in lookup table.
I have tried the above format, but it says no results found!!

Thanks in advance.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You can list as many lookup and output fields as you like:

... | lookup <lookup-table-name> <lookup-field1> AS <local-field1>, <lookup-field2> AS <local-field2> OUTPUT <lookup-destfield1> AS <local-destfield1>, <lookup-destfield2> AS <local-destfield2> 

No need to link them with AND.

edschembor
Path Finder

Thank you!!!

0 Karma

somesoni2
Revered Legend

You don't need the second "EntityKey OUTPUT" thing. This should work just fine. (see the syntax mentioned in @martin's answer.

| lookup local=1 XXX_Lookup_2 EntityKey OUTPUT Paymenttransactionkey as Paymenttranstemp, DISPLAYTRANSACTIONID as OPICTemp

edschembor
Path Finder

This doesnt work. I get: "Error in 'lookup' command: Could not find all of the specified destination fields in the lookup table."

My lookup now looks like:

| lookup local=1 XXX_Lookup_2 EntityKey OUTPUT Paymenttransactionkey as Paymenttranstemp, EntityKey OUTPUT DISPLAYTRANSACTIONID as OPICTemp

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...