Splunk Search

multiple outputlookup in one search

ryastrebov
Communicator

Hello!
It is possible to use multiple outputlookup in one search?

For example,

| table Field1, Field2, Field3, Field4 | outputlookup Lookup1 | outputlookup Lookup2

I would like to put in Lookup1 Field1 and Field3, and in Lookup2 - Field2 and Field4

No possibility?

Tags (3)

Jason
Motivator

When you use table or fields - the other fields get thrown away. You could likely to both, but you could need to put Field1 Field2 Field3 Field4 in Lookup1, and then you can put Field2 and Field4 in Lookup2.

ryastrebov
Communicator

Thank you!
I know that if I put into Lookup1 all fields, I can them put part of it to Lookup2.
But can I limit the number of fields in Lookup1, but that after the pipeline remained in search of all the fields?

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...