Splunk Search

multiple outputlookup in one search

ryastrebov
Communicator

Hello!
It is possible to use multiple outputlookup in one search?

For example,

| table Field1, Field2, Field3, Field4 | outputlookup Lookup1 | outputlookup Lookup2

I would like to put in Lookup1 Field1 and Field3, and in Lookup2 - Field2 and Field4

No possibility?

Tags (3)

Jason
Motivator

When you use table or fields - the other fields get thrown away. You could likely to both, but you could need to put Field1 Field2 Field3 Field4 in Lookup1, and then you can put Field2 and Field4 in Lookup2.

ryastrebov
Communicator

Thank you!
I know that if I put into Lookup1 all fields, I can them put part of it to Lookup2.
But can I limit the number of fields in Lookup1, but that after the pipeline remained in search of all the fields?

0 Karma
Get Updates on the Splunk Community!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...