lookup usage in query

[sahana]

Hi,

I have a requirement like we have a csv file which has the values of functionid and functiondesc, this file was added in lookup also. I get a value eventid from the logs which is same as functionid. Now,  we need to fetch  the functiondesc of the corresponding eventid. and display it in table.

[sahana]

I was suppose to get functiondesc value using eventid?

[ITWhisperer]

That's how the lookup command work (you can alias the field name from the event to be the same as the field name from the lookup)

lookup

Description

Use the lookup command to invoke field value lookups.

For information about the types of lookups you can define, see About lookups in the Knowledge Manager Manual.

Syntax

The required syntax is in bold.

lookup [local=<bool>] [update=<bool>] <lookup-table-name> ( <lookup-field> [AS <event-field>] )... [ OUTPUT | OUTPUTNEW (<lookup-destfield> [AS <event-destfield>] )... ] https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Lookup

[ITWhisperer]

| lookup csv_store functionid as eventid