I have source data and i have inputlookup data, now i need to match them with column, but column name in source is Student and Column name in Inputlookup is Roll_Number. How can i match them?
Manually, you can just do it in the lookup command.
<your search terms> |lookup MyLookupName Roll_Number as Student
Or if you want to have the lookup run automatically whenever Splunk deals with these events you can either put a pretty similar looking syntax into props.conf, or what's a lot easier is to do it all in the Settings UI.
some key docs on Automatic Lookups -
https://docs.splunk.com/Documentation/Splunk/6.4.3/Knowledge/Usefieldlookupstoaddinformationtoyourev...
https://docs.splunk.com/Documentation/Splunk/6.4.3/Knowledge/Makeyourlookupautomatic
Some docs about the lookup command -
http://docs.splunk.com/Documentation/Splunk/6.4.3/SearchReference/Lookup
Manually, you can just do it in the lookup command.
<your search terms> |lookup MyLookupName Roll_Number as Student
Or if you want to have the lookup run automatically whenever Splunk deals with these events you can either put a pretty similar looking syntax into props.conf, or what's a lot easier is to do it all in the Settings UI.
some key docs on Automatic Lookups -
https://docs.splunk.com/Documentation/Splunk/6.4.3/Knowledge/Usefieldlookupstoaddinformationtoyourev...
https://docs.splunk.com/Documentation/Splunk/6.4.3/Knowledge/Makeyourlookupautomatic
Some docs about the lookup command -
http://docs.splunk.com/Documentation/Splunk/6.4.3/SearchReference/Lookup
Thank you very much, now I could match and see the results.