Building for the Splunk Platform

Lookup values with search results

avaishsplunk
Path Finder
I have a lookup as mentioned below:

Message#, MessageDesc
1234, Error

In my search criteria,I am getting output like

Message#, Code, _raw,_time
1234, abcd, this error 1234 caused issues, 2017-02-21 06:40:32

Now I want my complete output as

Message#, MessageDesc,Code, _raw,_time
1234,Error, abcd, this error 1234 caused issues, 2017-02-21 06:40:32

I tried different options but not able to get the _raw and _time values
Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

You need to do other way around. Try this (check the field names should be exactly same)

your current search giving fields Message#, Code, _raw,_time
| lookup yourlookup.csv "Message#" OUTPUT MessageDesc
| table Message#, MessageDesc,Code, _raw,_time

View solution in original post

0 Karma

somesoni2
Revered Legend

You need to do other way around. Try this (check the field names should be exactly same)

your current search giving fields Message#, Code, _raw,_time
| lookup yourlookup.csv "Message#" OUTPUT MessageDesc
| table Message#, MessageDesc,Code, _raw,_time
0 Karma

avaishsplunk
Path Finder

Thanks I was able to figure out the issue and have used the same logic but thanks a lot for the prompt help

0 Karma
Get Updates on the Splunk Community!

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...