Splunk Search

lookup table issues

Path Finder

I have a lookup table set up like

lookup table name A1_timer

field_a   filed_b
test1     value1
test2     value2

source A1 looks like

field_A = test1  field_B = foo field_C = bar

I would like my output to look like:

field_A from source A1, field_b from lookup table A1_timer, field_B from source A1, field_C from source A1

source="A1.txt" lookup A1_timer A1_a OUTPUT A1_A A1_timer_b A1_b A1_c

the value in the source file A1.txt in filed A1_a is equal to lookup table A1_timer value A1_timer_a

I'm also getting sourcetype too small on my lookup table

any ideas?

Tags (2)


There are some field name inconsistencies between your description and your example...

Based on your description, try this:

source="A1.txt" | lookup A1_timer field_A AS field_a | table field_A field_b field_B field_C 

Three separate steps: search, lookup, and formatting.

Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...