lookup query

[pacifikn]

Greetings!!

I have created a new lookup table xyz.csv that contain host and hostname(as description) and the name of lookup is xyz_lookup

when i search |inputlookup xyz_lookup I got the table with host and hostname,

BUT my question is:
what query can I use to combine the other command with this lookup,

when I search for index= xx sourcetype=ttt |top host -this gives me host,count,percent BUT i want also to use that it gives me also hostname , not only host ...

Help me on how I could combine my lookup with other query? Thank you in advance

regards
paci N

[pacifikn]

Thank you All for your quick response,

I didn't tell soon , I have tried to use OUTPUTNEW and it is working correctly,

index=xxx sourrcetype=tttt action=T |top host |lookup name_lookup host OUTPUTNEW hostname

I used the above command and it was working correctly.

Thank you again for the other way you mentioned above it is also working good! thank you all

[to4kawa]

index= xx sourcetype=ttt 
|top host
|lookup xyz_lookup 

Hi, @pacifikn
how is it?

[pacifikn]

Dear to4kawa ,

now it is working good , but when I saw the command you wrote, it looks the same with the one I used but I added the name of the firstColumn OUTPUTNEW secondColumn(description of the first column)

like this:
index= xx sourcetype=ttt
|top host
|lookup xyz_lookup host OUTPUTNEW hostname(Desc)

[raduurjan]

Hello!

You can try to output your inputlookup results (since inputlookup should be the first item in your search) with the MAP command to combine results.

You can find more info about this in the following posts:

https://docs.splunk.com/Documentation/SplunkCloud/8.0.0/SearchReference/Map
https://answers.splunk.com/answers/743935/problem-with-map-command-using-search-from-lookup.html