Hello, I've been banging my head against the wall over the last like two hours over this and figured I should just post since I don't find Splunk documentation that helpful, detailed, or plentiful.
Objective: What I want to do is we have the results from a nice search query. Now we want to take the full hostname and compare that to a field in the Lookup and from there bringing in an related alternate field from that lookup.
The example hopefully is easy to understand and something quick I'm just screwing up.
So our query below is returning us the following:
What I want to accomplish is use the CSV lookup file I have, use the clienthost field and compare that against the DNS field in my lookup file. And from there automatically pull in the matching related value from Description. Does that make sense hopefully. I tried every variation of using | | lookup ComputerNameDescription.csv DNS as clienthost OUTPUT Description, etc. Idk. I tried like 20 different ways and it's not looking it up, matching and letting me bring in the matching Description.
Can someone please tell me what we're doing wrong.
Thanks
... View more