Splunk Search

multiple outputlookup in one search

ryastrebov
Communicator

Hello!
It is possible to use multiple outputlookup in one search?

For example,

| table Field1, Field2, Field3, Field4 | outputlookup Lookup1 | outputlookup Lookup2

I would like to put in Lookup1 Field1 and Field3, and in Lookup2 - Field2 and Field4

No possibility?

Tags (3)

Jason
Motivator

When you use table or fields - the other fields get thrown away. You could likely to both, but you could need to put Field1 Field2 Field3 Field4 in Lookup1, and then you can put Field2 and Field4 in Lookup2.

ryastrebov
Communicator

Thank you!
I know that if I put into Lookup1 all fields, I can them put part of it to Lookup2.
But can I limit the number of fields in Lookup1, but that after the pipeline remained in search of all the fields?

0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...