Splunk Search

Using lookup tables

jbouch03
Path Finder

Having trouble getting a lookup table to replace my results. I have a lookup file that contains the following info:

AET,Location
FakeAET,Fakeplace

I have loaded the .csv file, and I have created a file-based lookup definition called AETtolocation. When I run my search I want to replace the results of the AET column with the info in the Location column, but everytime I run it I only get the information inside the AET column. Here is my searchstring:

eventtype="calling" | chart count by calling | lookup AETtolocation AET OUTPUT Location

Any assistance you could provide would be greatly appreciated. Thank you in advance.

Tags (2)
1 Solution

Ayn
Legend

The lookup command is doing precisely what it's told to do. The stuff before OUTPUT is which fields you want to use as input to your lookup and the stuff after OUTPUT is which fields should be output. In your case the lookup will read the value of the field "AET" in your event, try to match it to its "AET" values and if it finds a match, it will write the matching value in the "Location" field in your event.

If you want to output to another field you can do it like this:

... | lookup AETtolocation AET OUTPUT Location AS AET

More info in the docs: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Lookup

View solution in original post

Ayn
Legend

The lookup command is doing precisely what it's told to do. The stuff before OUTPUT is which fields you want to use as input to your lookup and the stuff after OUTPUT is which fields should be output. In your case the lookup will read the value of the field "AET" in your event, try to match it to its "AET" values and if it finds a match, it will write the matching value in the "Location" field in your event.

If you want to output to another field you can do it like this:

... | lookup AETtolocation AET OUTPUT Location AS AET

More info in the docs: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Lookup

jbouch03
Path Finder

I got it...It was extra spacing in my results. I fixed the spacing in my transform and it went perfectly. thanks again.

Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...