Outputlookup followed by stats command causes extra column to be generated

[Anders333]

Hello, I came across some unexpected search behaviour today.

When using the outputlookup command followed by a stats command, as in the example, an additional empty column is added to the lookup file.

| makeresults
| eval test = "this is a testing thing"
| outputlookup append=false testindjiasbhd8a0.csv
| stats values(test) as testing

Expected lookup table:

_time	test
2025-11-14 14:19:07	this is a testing thing

Actual lookup table:

_time	test	testing
2025-11-14 14:19:07	this is a testing thing

I don't know if this is a bug or expected behaviour., and I was unable to find anything that would explain it.

Thanks 🙂

[PrewinThomas]

@Anders333 

The lookup file is created with the fields _time and test, then you run stats values(test) as testing. This produces a new field testing in the search results.
Splunk lookup files are schema‑flexible. If later commands introduce new fields, splunk adds them as new columns, even if they’re empty for existing rows.

If you need only testing field then write your outputlookup command after your stats.
Eg:

| makeresults
| eval test = "this is a testing thing"

| stats values(test) as testing | outputlookup append=false test.csv

Regards,
Prewin
🌟If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

[ITWhisperer · Accepted solution]

My understanding is that as part of the search processing, the processor determines which fields are required at the end and those are then available to be output by the outputlookup command. It doesn't have to be a stats command or even a field with any values. For example, a similar result will be shown if you try this:

| makeresults
| eval test = "this is a testing thing"
| outputlookup append=false testindjiasbhd8a0.csv
| table testing

However, you can work around this by removing the field before it is created

| makeresults
| eval test = "this is a testing thing"
| fields - testing
| outputlookup append=false testindjiasbhd8a0.csv
| stats values(test) as testing