Splunk Search

Specify Fields for Outputlookup or Outputcsv

mattcg
Explorer

How can I get outputlookup or outputcsv to only include certain fields in the resulting lookup file?

An example explains it better:

SEARCH | DEDUP FieldName1 | FIELDS FieldName1, FieldName2 | OUTPUTLOOKUP lookupFile.csv

I want the resulting lookup file to be formatted with just an entry of "FieldValue1, FieldValue2" per line per result. I do not want the full raw logs in the lookup as it seems to be doing.

1 Solution

ziegfried
Influencer
<search> | dedup FieldName1 | table FieldName1 FieldName2 | outputlookup mylookup

View solution in original post

ziegfried
Influencer
<search> | dedup FieldName1 | table FieldName1 FieldName2 | outputlookup mylookup

nick405060
Motivator

I downvoted this post because this isn't an elegant solution. I don't want to table my fields before I output because there are other fields that I don't want to output but that I want to keep to do other processing with.

n0vsec
Explorer

Did you ever find an answer to this?  I wanting to do a similar search.  I only want to append specific fields to a lookup table, while keeping the rest of the fields for alert automation.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...