Lookups - How to limit/eliminate multiple matches

[chris]

Hi

We have a automatic csv lookup for a specific source, for the host field.

Some hosts will have the lookup fields added multiple times to an event. We have the impression that this is because the host exists in several rows/lines/records in the csv-File. Most of the fields for all rows are the same. But a hostname can have multiple different aliases and that translates into 1 row per alias with our csv.

Is there a way to tell the lookup to stop after the first match or should I just somehow sanitize my csv?

Thanks Chris

[gkanapathy]

You can also clean up your CSV very easily in Splunk by running:

| inputlookup mylookup | dedup host | outputlookup mylookup

which will eliminate all but the first distinct occurence of each host in the file.

[chris]

That works too thanks

[bwooden · Accepted solution]

By default, Splunk will return up to 100 matches for look-ups not involving a time element. You can update it to only return one.

For an automatic look-up, edit transforms.conf, and use max_matches like this:

[host_enchrichment]
filename = host_enrichment.csv
max_matches = 1

[chris]

Thank you that works