Splunk Search

lookup faup url restricted specific fields

dmilushev81
New Member

Hi everyone,

I want to run this
sourcetype=x | lookup faup url
but am ONLY interested in url, url_scheme, url_port.
Is there a way to specify this, so that the other ones ( url_subdomain,url_domain_without_tld) are NOT generated.
Hopefully, this would also make it faster.

Thanks!

Tags (1)
0 Karma

somesoni2
Revered Legend

You can use OUTPUT option in the lookup command to specify which fields from lookup you want to display

sourcetype=x | lookup faup url OUTPUT url url_scheme url_port

See more information here
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Lookup

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...