Translate ID to Name

[RobertRi]

Hi

I'm using 4.1 and I want to translate an ID, which came from a search result, into a Name from an importet csv file. Is this possible and if yes how can I do this ?

Thanks Rob

[ziegfried · Accepted solution]

Yes, this is possible by using Splunk's lookup feature. See http://www.splunk.com/base/Documentation/4.1.5/User/Fieldlookupstutorial

[ziegfried]

Bitteschön 😉 You can eliminate those events in the result by adding fieldname=* to the search criteria.

[RobertRi]

Vielen Dank

Another question for my issue. If my search doesn't return a requiered field, how can I suppress this event