Splunk Search

reference lookup name in table

jat75
Explorer

I have a search where I am doing 2 inputlookups for 2 different lookups and appending them. Then I search them. Can I table the lookup name as a field for where the result was found? Thanks.

Labels (1)
0 Karma

jat75
Explorer

From a nice bloke on reddit:

Example if you are using lookups normally:

| lookup my_lookup1.csv field1 OUTPUT outfield1
| lookup my_lookup2.csv field1 OUTPUT outfield2
| eval outfield = coalesce(outfield1,outfield2,"not found")
| eval tablesource = case(isnotnull(outfield1),"my_lookup1.csv",
 isnotnull(outfield2),"my_lookup2.csv",
 true(),"not found")

Example if you are using inputlookup:

 | inputlookup my_lookup1.csv 
 | eval tablesource="my_lookup1.csv"
 | inputlookup my_lookup2.csv append=true
 | eval tablesource=coalesce(tablesource,"my_lookup2.csv")
0 Karma
Get Updates on the Splunk Community!

The OpenTelemetry Certified Associate (OTCA) Exam

What’s this OTCA exam? The Linux Foundation offers the OpenTelemetry Certified Associate (OTCA) credential to ...

From Manual to Agentic: Level Up Your SOC at Cisco Live

Welcome to the Era of the Agentic SOC   Are you tired of being a manual alert responder? The security ...

Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 4)

Welcome back to Splunk Classroom Chronicles, our ongoing series where we shine a light on what really happens ...