Using lookup tables

[jbouch03]

Having trouble getting a lookup table to replace my results. I have a lookup file that contains the following info:

AET,Location
FakeAET,Fakeplace

I have loaded the .csv file, and I have created a file-based lookup definition called AETtolocation. When I run my search I want to replace the results of the AET column with the info in the Location column, but everytime I run it I only get the information inside the AET column. Here is my searchstring:

eventtype="calling" | chart count by calling | lookup AETtolocation AET OUTPUT Location

Any assistance you could provide would be greatly appreciated. Thank you in advance.

[Ayn · Accepted solution]

The lookup command is doing precisely what it's told to do. The stuff before OUTPUT is which fields you want to use as input to your lookup and the stuff after OUTPUT is which fields should be output. In your case the lookup will read the value of the field "AET" in your event, try to match it to its "AET" values and if it finds a match, it will write the matching value in the "Location" field in your event.

If you want to output to another field you can do it like this:

... | lookup AETtolocation AET OUTPUT Location AS AET

More info in the docs: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Lookup

[jbouch03]

I got it...It was extra spacing in my results. I fixed the spacing in my transform and it went perfectly. thanks again.