Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How do I search a match a specific source against an input lookup

$
0
0
I am attempting to run the below, however I am not getting any results. **source="source.tsv" [|inputlookup appname| fields inputfield AS "field"]** I can search **source="source.tsv"** and get the fields displayed, and **|inputlookup appname| fields inputfield AS "field"** and displays fine, but when I attempt to combine them to get a match, I get no results. I understand that this only provides a result when there is a match but I have inserted a field that should trigger a match. Can anyone please help point me in the right direction?

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>