Splunk Search

How to perform two lookups with same table and two different lookup fields?

the_wolverine
Champion

I am having trouble getting this to work. I have a lookup table with 4 columns:

A,B,C,D
=======
1,a,,,
,,2,b

I want to perform 2 lookups in the same query:

search | lookup mylookup.csv A | lookup mylookup.csv C

Should this work?

Labels (2)
0 Karma
1 Solution

the_wolverine
Champion

The solution is to use OUTPUTNEW which looks like it tells Splunk not to overwrite the field.

search | lookup mylookup.csv A OUTPUTNEW B | lookup mylookup.csv C OUTPUTNEW D

View solution in original post

the_wolverine
Champion

The solution is to use OUTPUTNEW which looks like it tells Splunk not to overwrite the field.

search | lookup mylookup.csv A OUTPUTNEW B | lookup mylookup.csv C OUTPUTNEW D

lmonahan
Path Finder

Thanks for this answer!  It was helpful to realize that using the same output name is overwriting.

I did the following as well to collapse the output fields back into one field.

search 
| lookup mylookup.csv A OUTPUTNEW B
| lookup mylookup.csv C OUTPUTNEW D
| lookup mylookup.csv E OUTPUTNEW F
| lookup mylookup.csv G OUTPUTNEW H
| eval allInOneAgain = coalesce(B, D , F ,H)
| fields - B D F H

 

0 Karma

yannK
Splunk Employee
Splunk Employee

I wonder if the output of the first lookup do not erase your C field.
see http://docs.splunk.com/Documentation/Splunk/5.0.1/SearchReference/Lookup

try
search | lookup mylookup.csv A output B | lookup mylookup.csv C output D

or test to save the result in new fields to verify how the fields get's populated

search | lookup mylookup.csv A output A as firstA B AS firstB C as firstC D as firstD | lookup mylookup.csv C output A as secondA B AS secondB C as second C D as secondD

the_wolverine
Champion

Yes, it appears that is what is happening. Or the 2nd lookup erases the first. I did come up with a kludgy workaround which is to create 2 lookup files so that there is no trampling.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...