Splunk Search

Lookup multiple values

edschembor
Path Finder

So I'm doing a lookup for multiple values, so similar to the following:

...| lookup entity OUTPUT x as XX y as YY

How can I do this with multiple values. Like instead would it be:

...| lookup entity OUTPUT x as XX AND y as YY

However I have tried both and neither has worked. Any ideas? Thanks!!!

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You can list as many lookup and output fields as you like:

... | lookup <lookup-table-name> <lookup-field1> AS <local-field1>, <lookup-field2> AS <local-field2> OUTPUT <lookup-destfield1> AS <local-destfield1>, <lookup-destfield2> AS <local-destfield2> 

No need to link them with AND.

View solution in original post

srujan9292
Explorer

Hi martin_mueller,

What should be the query if we need to perform the search on same local-field?

lookup lookup-table-name lookup-field1 AS local-field1, lookup-field2 AS local-field1
OUTPUT lookup-field1, lookup-field2, lookup-field3

Here lookup-field3 is corresponding field in lookup table.
I have tried the above format, but it says no results found!!

Thanks in advance.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You can list as many lookup and output fields as you like:

... | lookup <lookup-table-name> <lookup-field1> AS <local-field1>, <lookup-field2> AS <local-field2> OUTPUT <lookup-destfield1> AS <local-destfield1>, <lookup-destfield2> AS <local-destfield2> 

No need to link them with AND.

edschembor
Path Finder

Thank you!!!

0 Karma

somesoni2
Revered Legend

You don't need the second "EntityKey OUTPUT" thing. This should work just fine. (see the syntax mentioned in @martin's answer.

| lookup local=1 XXX_Lookup_2 EntityKey OUTPUT Paymenttransactionkey as Paymenttranstemp, DISPLAYTRANSACTIONID as OPICTemp

edschembor
Path Finder

This doesnt work. I get: "Error in 'lookup' command: Could not find all of the specified destination fields in the lookup table."

My lookup now looks like:

| lookup local=1 XXX_Lookup_2 EntityKey OUTPUT Paymenttransactionkey as Paymenttranstemp, EntityKey OUTPUT DISPLAYTRANSACTIONID as OPICTemp

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...