Thank you so much for this answer as it was 99% of the key to my resolution. The other 1% was adding in an 'as' to reference the IP field from the lookup to my data, then OUTPUT that to the newly created field |lookup hostnameLookup.csv IP as dest OUTPUT hostname Worked perfect and could not have done it without your awesomeness. Thank you! ... View more

Thanks for your response and I apologize for lack of clarity. I am working in the 'Network Toolkit' App under the 'Status Overview' portion to provide ICMP monitoring for various hosts. Currently the 'Status Overview' provides a 'dest' field that contains an IP address, and I would like to create an additional 'hostname' field respectively for easier reference with the IP of a particular host. Splunk support has provided me with a suggestion in creating a lookup which contains an IP address and Hostname imported via CSV file for each host. I've managed to create a lookup, but trying to use the 'inputlookup' command is failing for me probably because I am a noob and not using it correctly. An additional option is under 'Settings' / 'Data Inputs' / 'Ping' . Within this dash there is a 'name' field which is populated entering a new host from this dash. If I could somehow grab that field from here and merge with the data in the 'Status Overview' dash , that could work too. Any assist would be greatly appreciated on this. Btw I tried importing screen snips but don't see where to import within this. Thanks ... View more