Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Can I perform a lookup on 1 lookup field AS 2 existing fields?

$
0
0
Hello, I have two existing fields: mailto, mailfrom. I also have a lookup with 2 fields: "Mail" and "Country" I would like to perform a lookup like this: | lookup mail_country Mail AS mailfrom , Mail AS mailto OUTPUT Country But this doesn't work... I need to perform 2 lookups: | lookup mail_country Mail AS mailfrom OUTPUT Country | lookup mail_country Mail AS mailto OUTPUTNEW Country But I don't think it is efficient to perform 2 lookups like this...

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>