Splunk Search

multiple outputlookup in one search

ryastrebov
Communicator

Hello!
It is possible to use multiple outputlookup in one search?

For example,

| table Field1, Field2, Field3, Field4 | outputlookup Lookup1 | outputlookup Lookup2

I would like to put in Lookup1 Field1 and Field3, and in Lookup2 - Field2 and Field4

No possibility?

Tags (3)

Jason
Motivator

When you use table or fields - the other fields get thrown away. You could likely to both, but you could need to put Field1 Field2 Field3 Field4 in Lookup1, and then you can put Field2 and Field4 in Lookup2.

ryastrebov
Communicator

Thank you!
I know that if I put into Lookup1 all fields, I can them put part of it to Lookup2.
But can I limit the number of fields in Lookup1, but that after the pipeline remained in search of all the fields?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Observability Simplified: Combining User Experience, Application Performance & ...

Tech Talk Observability Simplified: Combining User Experience, Application Performance & Network ...

Event Series May & June: From Network Visibility to Service Intelligence

Unifying the Network: Moving from Alert Noise to Service Intelligence with Splunk ITSI In today’s hybrid ...

Global Splunk User Group Events: May + June 2026

Your Splunk Community Awaits: Discover Upcoming User Group Events Worldwide    Staying ahead in the fast-paced ...