Splunk Search
Highlighted

Pulling multiple Columns from an inputlookup

New Member

Trying to pull more than one column from an inputlookup. One of the columns maps to a field in the index I am searching in and the other I just want in as a category to table with. Struggling with how I would do that.

This is my current search and added subsearch:
index=myindex [| inputlookup my.csv | fields ip | rename ip as asset_ip] - I want to bring in a column named system from the lookup but don't need to rename it to fit into the index. I just want to make sure the system id in the lookup matches up to the appropriate ip for charting/tabling.

0 Karma
Highlighted

Re: Pulling multiple Columns from an inputlookup

SplunkTrust
SplunkTrust

I think you may need to use the lookup twice.

index=myindex [| inputlookup my.csv | fields ip | rename ip as asset_ip] | lookup my.csv ip as asset_ip output system
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma