Overwriting input field in lookup

[izzy]

I have a question regarding lookup tables. I want to create a lookup that places the output in the same field as the input.

Let's say I have the following lookup table defined:
num,name
80,http
25,smtp

And the search returns a field named src_port with a value of 80.

I want a search that replaces the content of src_port with http. If the lookup doesn't produce any results then the original contents should remain.

This is what I've tried but it doesn't work. The result is that the field src_port is not available at all. | lookup convert-portnum num AS src_port OUTPUT name AS src_port

However, the same search using a different output field produces the expected result. | lookup convert-portnum num AS src_port OUTPUT name AS src_port_name

Has anyone gotten something like this to work?

Thanks

[niemesrw]

Not sure when it was introduced, but you can now overwrite with a lookup:

http://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Lookup

[gkanapathy]

It is not possible to do this. You can rename or eval the field after the lookup instead.

[izzy]

oh well, it would have been nice
thanks for the reply