Splunk Dev

Lookup values with search results

avaishsplunk
Path Finder
I have a lookup as mentioned below:

Message#, MessageDesc
1234, Error

In my search criteria,I am getting output like

Message#, Code, _raw,_time
1234, abcd, this error 1234 caused issues, 2017-02-21 06:40:32

Now I want my complete output as

Message#, MessageDesc,Code, _raw,_time
1234,Error, abcd, this error 1234 caused issues, 2017-02-21 06:40:32

I tried different options but not able to get the _raw and _time values
Tags (1)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

You need to do other way around. Try this (check the field names should be exactly same)

your current search giving fields Message#, Code, _raw,_time
| lookup yourlookup.csv "Message#" OUTPUT MessageDesc
| table Message#, MessageDesc,Code, _raw,_time

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

You need to do other way around. Try this (check the field names should be exactly same)

your current search giving fields Message#, Code, _raw,_time
| lookup yourlookup.csv "Message#" OUTPUT MessageDesc
| table Message#, MessageDesc,Code, _raw,_time
0 Karma

avaishsplunk
Path Finder

Thanks I was able to figure out the issue and have used the same logic but thanks a lot for the prompt help

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...