×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
dgitdos
Loves-to-Learn
Member since: ‎11-02-2020
‎04-10-2025
Community Statistics
Posts 2
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎11-02-2020
Activity Feed
View All

Re: Append data from an Index to a lookup

by in Splunk Search
‎11-03-2020 03:50 PM
‎11-03-2020 03:50 PM
Hey @gcusello ,   Thanks for your suggestion! I ran the search but I seem to be getting more results than I was expecting.  Let me see if I can clear up what I am wanting. I don't want to add any new hostnames. I just want to take the Hostnames that I have in the lookup.csv and have their associated user added.    lookup.csv contains lets say 200 hostnames Devices Device1 Device2 Device 3 Device200 Index contains hostnames and associated users + a bunch of other data.    I want to use the index data to fill in the user field for the 200 devices that I have.    Thanks so much for your help! ... View more

Append data from an Index to a lookup

by in Splunk Search
‎11-02-2020 08:11 PM
‎11-02-2020 08:11 PM
Hello,    Splunk newbie here. I have a CSV file with a bunch of hostnames titled 'Device' that I added as a lookup 'hostnames.csv'. I have an index that has ComputerName, User, and a bunch of other fields. I want the Index data to enrich my csv data by adding the User that corresponds to the hostname. I will then export back to csv to hand the data to someone else.  Does anyone have some pointers so I can achieve this?   I was looking at other similar posts, but I couldn't figure out if I need append, outputlookup, join or something else. This is what I have so far.    |inputlookup lookup.csv | append [ search index=data source=Source1 Code=22] | rename Device as ComputerName | table ComputerName user_email  ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎04-10-2025 12:34 PM