Splunk Search

Lookup multiple values

edschembor
Path Finder

So I'm doing a lookup for multiple values, so similar to the following:

...| lookup entity OUTPUT x as XX y as YY

How can I do this with multiple values. Like instead would it be:

...| lookup entity OUTPUT x as XX AND y as YY

However I have tried both and neither has worked. Any ideas? Thanks!!!

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You can list as many lookup and output fields as you like:

... | lookup <lookup-table-name> <lookup-field1> AS <local-field1>, <lookup-field2> AS <local-field2> OUTPUT <lookup-destfield1> AS <local-destfield1>, <lookup-destfield2> AS <local-destfield2> 

No need to link them with AND.

View solution in original post

srujan9292
Explorer

Hi martin_mueller,

What should be the query if we need to perform the search on same local-field?

lookup lookup-table-name lookup-field1 AS local-field1, lookup-field2 AS local-field1
OUTPUT lookup-field1, lookup-field2, lookup-field3

Here lookup-field3 is corresponding field in lookup table.
I have tried the above format, but it says no results found!!

Thanks in advance.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You can list as many lookup and output fields as you like:

... | lookup <lookup-table-name> <lookup-field1> AS <local-field1>, <lookup-field2> AS <local-field2> OUTPUT <lookup-destfield1> AS <local-destfield1>, <lookup-destfield2> AS <local-destfield2> 

No need to link them with AND.

edschembor
Path Finder

Thank you!!!

0 Karma

somesoni2
Revered Legend

You don't need the second "EntityKey OUTPUT" thing. This should work just fine. (see the syntax mentioned in @martin's answer.

| lookup local=1 XXX_Lookup_2 EntityKey OUTPUT Paymenttransactionkey as Paymenttranstemp, DISPLAYTRANSACTIONID as OPICTemp

edschembor
Path Finder

This doesnt work. I get: "Error in 'lookup' command: Could not find all of the specified destination fields in the lookup table."

My lookup now looks like:

| lookup local=1 XXX_Lookup_2 EntityKey OUTPUT Paymenttransactionkey as Paymenttranstemp, EntityKey OUTPUT DISPLAYTRANSACTIONID as OPICTemp

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...