Splunk Search

Lookup table outputs not appearing in main window of search app

smileyge
Path Finder

When I do a search on events and lookup to a file, I get all the outputs on the left as fields and I can filter and see data on them, but the output fields do not appear in the event data itself int he main window or exports of that data. How do I get the Lookup table output fields to show there as well?

Tags (2)
0 Karma
1 Solution

smileyge
Path Finder

Interesting, one must use the As to define it as a local variable to use it in the main window, otherwise the field is only available in the filters on the left hand side. Maybe that's a bug.

So
| lookup user output UserGroup - does not work
| lookup user output UserGroup as UserGroup - works

View solution in original post

0 Karma

smileyge
Path Finder

Interesting, one must use the As to define it as a local variable to use it in the main window, otherwise the field is only available in the filters on the left hand side. Maybe that's a bug.

So
| lookup user output UserGroup - does not work
| lookup user output UserGroup as UserGroup - works

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...