Use Lookup to Add MetaData to Results

[aapittts]

If I have a lookup table with ID's and descriptions, is it possible to use the lookup table to add the corresponding descriptions to the ID's in search results?

I thought this was the purpose of the lookup command but I'm not getting anywhere using it.

If I have a list of codes, how to I use a lookup table to match the codes with the descriptions and output the code and description to the search results?

Lookup:

code,desc
1234,lorem ipsum
4567,lorem ipsum

desc is not a field in my transforms.conf. Does that matter?

[aapittts · Accepted solution]

Hopefully this helps another newb such as myself.

Search term is: | lookup TableName LookupField as LocalField

LookupField = Field in LookupTable

LocalField = Field in Splunk

[Ayn]

That is definitely how you can use lookups. You should provide more information on your scenario and what you're trying so we can help you troubleshoot your issue.