Hi,
I have a requirement like we have a csv file which has the values of functionid and functiondesc, this file was added in lookup also. I get a value eventid from the logs which is same as functionid. Now, we need to fetch the functiondesc of the corresponding eventid. and display it in table.
I was suppose to get functiondesc value using eventid?
That's how the lookup command work (you can alias the field name from the event to be the same as the field name from the lookup)
Use the lookup command to invoke field value lookups.
For information about the types of lookups you can define, see About lookups in the Knowledge Manager Manual.
The required syntax is in bold.
lookup [local=<bool>] [update=<bool>] <lookup-table-name> ( <lookup-field> [AS <event-field>] )... [ OUTPUT | OUTPUTNEW (<lookup-destfield> [AS <event-destfield>] )... ] https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Lookup
| lookup csv_store functionid as eventid