Splunk Search

lookup query

pacifikn
Communicator

Greetings!!

I have created a new lookup table xyz.csv that contain host and hostname(as description) and the name of lookup is xyz_lookup

when i search |inputlookup xyz_lookup I got the table with host and hostname,

BUT my question is:
what query can I use to combine the other command with this lookup,

when I search for index= xx sourcetype=ttt |top host -this gives me host,count,percent BUT i want also to use that it gives me also hostname , not only host ...

Help me on how I could combine my lookup with other query? Thank you in advance

regards
paci N

Tags (1)
0 Karma

pacifikn
Communicator

Thank you All for your quick response,

I didn't tell soon , I have tried to use OUTPUTNEW and it is working correctly,

index=xxx sourrcetype=tttt action=T |top host |lookup name_lookup host OUTPUTNEW hostname

I used the above command and it was working correctly.

Thank you again for the other way you mentioned above it is also working good! thank you all

0 Karma

to4kawa
Ultra Champion
index= xx sourcetype=ttt 
|top host
|lookup xyz_lookup 

Hi, @pacifikn
how is it?

0 Karma

pacifikn
Communicator

Dear to4kawa ,

now it is working good , but when I saw the command you wrote, it looks the same with the one I used but I added the name of the firstColumn OUTPUTNEW secondColumn(description of the first column)

like this:
index= xx sourcetype=ttt
|top host
|lookup xyz_lookup host OUTPUTNEW hostname(Desc)

0 Karma

raduurjan
Explorer

Hello!

You can try to output your inputlookup results (since inputlookup should be the first item in your search) with the MAP command to combine results.

You can find more info about this in the following posts:

https://docs.splunk.com/Documentation/SplunkCloud/8.0.0/SearchReference/Map
https://answers.splunk.com/answers/743935/problem-with-map-command-using-search-from-lookup.html

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...