Splunk Dev

Lookup values with search results

avaishsplunk
Path Finder
I have a lookup as mentioned below:

Message#, MessageDesc
1234, Error

In my search criteria,I am getting output like

Message#, Code, _raw,_time
1234, abcd, this error 1234 caused issues, 2017-02-21 06:40:32

Now I want my complete output as

Message#, MessageDesc,Code, _raw,_time
1234,Error, abcd, this error 1234 caused issues, 2017-02-21 06:40:32

I tried different options but not able to get the _raw and _time values
Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

You need to do other way around. Try this (check the field names should be exactly same)

your current search giving fields Message#, Code, _raw,_time
| lookup yourlookup.csv "Message#" OUTPUT MessageDesc
| table Message#, MessageDesc,Code, _raw,_time

View solution in original post

0 Karma

somesoni2
Revered Legend

You need to do other way around. Try this (check the field names should be exactly same)

your current search giving fields Message#, Code, _raw,_time
| lookup yourlookup.csv "Message#" OUTPUT MessageDesc
| table Message#, MessageDesc,Code, _raw,_time
0 Karma

avaishsplunk
Path Finder

Thanks I was able to figure out the issue and have used the same logic but thanks a lot for the prompt help

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...