Is there any way to get those header names as field values from lookup files?
Please give me any idea with SPL
You could transpose, duplicate the header column and transpose again
| inputlookup lookup.csv
| transpose 0 header_field="NAME" column_name="NAME"
| eval header=NAME
| transpose 0 header_field=header column_name="NAME"
Can you explain the use case a little bit more? This looks like it might be a screenshot from Microsoft Excel.
Have you looked into the Lookup File Editor App? https://splunkbase.splunk.com/app/1724/
Thank you for answering @ryanoconnor
I actually wanted to set a dropdown list of lookup header values on dashboard and make it possible to choose a primary key to lookup reference field dynamically.
Thank you for your kindness.
You could transpose, duplicate the header column and transpose again
| inputlookup lookup.csv
| transpose 0 header_field="NAME" column_name="NAME"
| eval header=NAME
| transpose 0 header_field=header column_name="NAME"
Thank you so much, @ITWhisperer
This way is exactly I wanted.