Splunk Search

Can a field extraction and lookup share the same field name?

carmackd
Communicator

Is it possible for a field generated by an automatic lookup to share the same name as a field generated by an extraction?

For example, I have a signature_id field, which is fed into a lookup table and returns a field called signature. Not every event has a signature_id so I need to use a field extraction on the same log source to pull signature values. This extracted field would also be called signature.

So far I haven't been able to do this. I've extracted the signature values fine, and the lookup table returns the values as it should, but I can not name them both signature. Is there a configuration that would allow me to do this?

Tags (1)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

You can, but by default the lookup will not overwrite a target field if it already exists in the event. You can make it do the overwrite by using OUTPUTNEW rather than OUTPUT when defining the lookup.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

You can, but by default the lookup will not overwrite a target field if it already exists in the event. You can make it do the overwrite by using OUTPUTNEW rather than OUTPUT when defining the lookup.

carmackd
Communicator

Thanks! worked like a charm

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...