Hi all,
I'm stuck with this i hope somebody can helps me.
I have a csv lookup with following data for search matches on my previous indexed data
Hostname, Vendor,Product, Version
mke001,apache,http_server,2.4.38
Mke003,apache,http_server,2.3.3
I want to add hostname column to following query:
index=main | table Vendor Product Version | search [ | inputlookup inventory.csv | table Vendor Product Version ]
Try this (I forget if you can use multiple values for the matching part of the lookup the This as That part):
index=main
| table Vendor Product Version
| lookup Vendor as Vendor Product as Product Version as Version OUTPUT Hostname
Hi @cpm003,
Check out this answer :
https://answers.splunk.com/answers/135646/lookup-command-multiple-input-fields.html
You can do what you're looking for pretty easily :
Note: The lookup command can accept multiple lookup and local fields and destfields. For example:
lookup <lookup-table-name> <lookup-field1> AS <local-field1>, <lookup-field2> AS <local-field2> OUTPUTNEW <lookup-destfield1> AS <local-destfield1>, <lookup-destfield2> AS <local-destfield2>
So your search should look like this :
index=main | table Vendor Product Version | lookup Vendor,Product,Version OUTPUT Hostname
Cheers,
David
Try this (I forget if you can use multiple values for the matching part of the lookup the This as That part):
index=main
| table Vendor Product Version
| lookup Vendor as Vendor Product as Product Version as Version OUTPUT Hostname