If I have a lookup table with ID's and descriptions, is it possible to use the lookup table to add the corresponding descriptions to the ID's in search results?
I thought this was the purpose of the lookup
command but I'm not getting anywhere using it.
If I have a list of codes, how to I use a lookup table to match the codes with the descriptions and output the code and description to the search results?
Lookup:
code,desc
1234,lorem ipsum
4567,lorem ipsum
desc is not a field in my transforms.conf. Does that matter?
Hopefully this helps another newb such as myself.
Search term is: | lookup TableName LookupField as LocalField
LookupField = Field in LookupTable
LocalField = Field in Splunk
Hopefully this helps another newb such as myself.
Search term is: | lookup TableName LookupField as LocalField
LookupField = Field in LookupTable
LocalField = Field in Splunk
That is definitely how you can use lookups. You should provide more information on your scenario and what you're trying so we can help you troubleshoot your issue.