Splunk Search

multiple outputlookup in one search

ryastrebov
Communicator

Hello!
It is possible to use multiple outputlookup in one search?

For example,

| table Field1, Field2, Field3, Field4 | outputlookup Lookup1 | outputlookup Lookup2

I would like to put in Lookup1 Field1 and Field3, and in Lookup2 - Field2 and Field4

No possibility?

Tags (3)

Jason
Motivator

When you use table or fields - the other fields get thrown away. You could likely to both, but you could need to put Field1 Field2 Field3 Field4 in Lookup1, and then you can put Field2 and Field4 in Lookup2.

ryastrebov
Communicator

Thank you!
I know that if I put into Lookup1 all fields, I can them put part of it to Lookup2.
But can I limit the number of fields in Lookup1, but that after the pipeline remained in search of all the fields?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...