Splunk Search

lookup table issues

fresned
Path Finder

I have a lookup table set up like

lookup table name A1_timer

field_a   filed_b
test1     value1
test2     value2

source A1 looks like

field_A = test1  field_B = foo field_C = bar

I would like my output to look like:

field_A from source A1, field_b from lookup table A1_timer, field_B from source A1, field_C from source A1

source="A1.txt" lookup A1_timer A1_a OUTPUT A1_A A1_timer_b A1_b A1_c

the value in the source file A1.txt in filed A1_a is equal to lookup table A1_timer value A1_timer_a

I'm also getting sourcetype too small on my lookup table

any ideas?

Tags (2)

jrwilk01
Explorer

There are some field name inconsistencies between your description and your example...

Based on your description, try this:

source="A1.txt" | lookup A1_timer field_A AS field_a | table field_A field_b field_B field_C 

Three separate steps: search, lookup, and formatting.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...