Does anyone know if it's possible to perform a lookup when using the powershell resource kit's search functionality? I'm currently on v4.2 and saw that lookup was added to the rest api in 4.3 so I'm guessing this won't be possible yet....
My really simple search is
find something | lookup myLookup name AS userName OUTPUTNEW Title AS Title
which works fine via the gui but not when using powershell
Thanks in advance
Turns out that if you add the -RequiredField flag to the search it returns the values from the lookup, ie:
$results = Search-Splunk -Search "find something `| lookup myLookup name AS userName OUTPUTNEW Title AS Title" -RequiredField "Title"
Turns out that if you add the -RequiredField flag to the search it returns the values from the lookup, ie:
$results = Search-Splunk -Search "find something `| lookup myLookup name AS userName OUTPUTNEW Title AS Title" -RequiredField "Title"
I hate to do this but I thought it might be worth giving this a little bump now that America is awake and at work
I promise not to make a habit of it 🙂