Splunk Search

.CSV file and lookup field

HY
Explorer

Do I need to create a .csv file for the lookup field section of a saved search for CPU,memory by myself or I just need to go online to get the file?

Tags (2)
0 Karma

MichaelPriest
Communicator

You would need to create a csv file for the lookup yourself so it includes all of the values you want to use in the lookup. Once you have done this download and follow the instructions in the Knowledge Manager Manual located here:

http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/Addfieldsfromexternaldatasources

Starting from page 129.

woodcock
Esteemed Legend

You need to be much more specific but in general, you do need to create a lookup file.