Splunk Search

Lookup multiple values

edschembor
Path Finder

So I'm doing a lookup for multiple values, so similar to the following:

...| lookup entity OUTPUT x as XX y as YY

How can I do this with multiple values. Like instead would it be:

...| lookup entity OUTPUT x as XX AND y as YY

However I have tried both and neither has worked. Any ideas? Thanks!!!

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You can list as many lookup and output fields as you like:

... | lookup <lookup-table-name> <lookup-field1> AS <local-field1>, <lookup-field2> AS <local-field2> OUTPUT <lookup-destfield1> AS <local-destfield1>, <lookup-destfield2> AS <local-destfield2> 

No need to link them with AND.

View solution in original post

srujan9292
Explorer

Hi martin_mueller,

What should be the query if we need to perform the search on same local-field?

lookup lookup-table-name lookup-field1 AS local-field1, lookup-field2 AS local-field1
OUTPUT lookup-field1, lookup-field2, lookup-field3

Here lookup-field3 is corresponding field in lookup table.
I have tried the above format, but it says no results found!!

Thanks in advance.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You can list as many lookup and output fields as you like:

... | lookup <lookup-table-name> <lookup-field1> AS <local-field1>, <lookup-field2> AS <local-field2> OUTPUT <lookup-destfield1> AS <local-destfield1>, <lookup-destfield2> AS <local-destfield2> 

No need to link them with AND.

edschembor
Path Finder

Thank you!!!

0 Karma

somesoni2
Revered Legend

You don't need the second "EntityKey OUTPUT" thing. This should work just fine. (see the syntax mentioned in @martin's answer.

| lookup local=1 XXX_Lookup_2 EntityKey OUTPUT Paymenttransactionkey as Paymenttranstemp, DISPLAYTRANSACTIONID as OPICTemp

edschembor
Path Finder

This doesnt work. I get: "Error in 'lookup' command: Could not find all of the specified destination fields in the lookup table."

My lookup now looks like:

| lookup local=1 XXX_Lookup_2 EntityKey OUTPUT Paymenttransactionkey as Paymenttranstemp, EntityKey OUTPUT DISPLAYTRANSACTIONID as OPICTemp

0 Karma
Get Updates on the Splunk Community!

The OpenTelemetry Certified Associate (OTCA) Exam

What’s this OTCA exam? The Linux Foundation offers the OpenTelemetry Certified Associate (OTCA) credential to ...

From Manual to Agentic: Level Up Your SOC at Cisco Live

Welcome to the Era of the Agentic SOC   Are you tired of being a manual alert responder? The security ...

Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 4)

Welcome back to Splunk Classroom Chronicles, our ongoing series where we shine a light on what really happens ...