Splunk Search

Specify Fields for Outputlookup or Outputcsv

mattcg
Explorer

How can I get outputlookup or outputcsv to only include certain fields in the resulting lookup file?

An example explains it better:

SEARCH | DEDUP FieldName1 | FIELDS FieldName1, FieldName2 | OUTPUTLOOKUP lookupFile.csv

I want the resulting lookup file to be formatted with just an entry of "FieldValue1, FieldValue2" per line per result. I do not want the full raw logs in the lookup as it seems to be doing.

1 Solution

ziegfried
Influencer
<search> | dedup FieldName1 | table FieldName1 FieldName2 | outputlookup mylookup

View solution in original post

ziegfried
Influencer
<search> | dedup FieldName1 | table FieldName1 FieldName2 | outputlookup mylookup

nick405060
Motivator

I downvoted this post because this isn't an elegant solution. I don't want to table my fields before I output because there are other fields that I don't want to output but that I want to keep to do other processing with.

n0vsec
Explorer

Did you ever find an answer to this?  I wanting to do a similar search.  I only want to append specific fields to a lookup table, while keeping the rest of the fields for alert automation.

0 Karma

mdorobek
Path Finder

| appendpipe [ | fields x y z | outputlookup lookup ]

n0vsec
Explorer

This is exactly what I was looking for!  One interesting thing I noticed, which I am not sure is a bug or not:

  • If you run outputlook up and _time is still in the initial pipeline it will output _time to the lookup
    • This happens even if you explicitly try to remove using the field command  
    • A work around would be to rename time, which works but is not ideal

Also to clean this up since this appends to the results of the initial pipeline you will need to follow with a where isnotnull(a), filtering out results on null values that should be present in the appended results.

So the resulting search would be something like:

...initial search...
``` If you don't want _time in your resulting lookup ```
| rename _time as time 
| convert ctime(time) 
``` Select fields for outputing to lookup ```
| appendpipe 
    [| fields a, b, c 
    | outputlookup lookup_file]
``` Remove appended entries by filtering on null fields which should only be present in the appended output ```
| where isnotnull(d)

 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...