Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Using lookup tables
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Having trouble getting a lookup table to replace my results. I have a lookup file that contains the following info:
AET,Location
FakeAET,Fakeplace
I have loaded the .csv file, and I have created a file-based lookup definition called AETtolocation. When I run my search I want to replace the results of the AET column with the info in the Location column, but everytime I run it I only get the information inside the AET column. Here is my searchstring:
eventtype="calling" | chart count by calling | lookup AETtolocation AET OUTPUT Location
Any assistance you could provide would be greatly appreciated. Thank you in advance.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The lookup command is doing precisely what it's told to do. The stuff before OUTPUT is which fields you want to use as input to your lookup and the stuff after OUTPUT is which fields should be output. In your case the lookup will read the value of the field "AET" in your event, try to match it to its "AET" values and if it finds a match, it will write the matching value in the "Location" field in your event.
If you want to output to another field you can do it like this:
... | lookup AETtolocation AET OUTPUT Location AS AET
More info in the docs: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Lookup
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The lookup command is doing precisely what it's told to do. The stuff before OUTPUT is which fields you want to use as input to your lookup and the stuff after OUTPUT is which fields should be output. In your case the lookup will read the value of the field "AET" in your event, try to match it to its "AET" values and if it finds a match, it will write the matching value in the "Location" field in your event.
If you want to output to another field you can do it like this:
... | lookup AETtolocation AET OUTPUT Location AS AET
More info in the docs: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Lookup
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I got it...It was extra spacing in my results. I fixed the spacing in my transform and it went perfectly. thanks again.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Build the Future of Agentic AI: Join the Splunk Agentic Ops Hackathon
[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions
Splunk Community Badges!
