Knowledge Management

Automatic Lookups on Internal Index

jarrex
Explorer

Is the _internal index exempt from automatic lookups? I can't get any automatic lookups working on the index even with global permissions selected to work on the internal index, it works everywhere except there. Is there no way to do this?

0 Karma

woodcock
Esteemed Legend

You have 2 problems; first you are swapping the lookup name and event name positions and you have extra spaces in your LOOKUP- name (or perhaps it was supposed to be a second input field and you forgot to use AS and put it in the wrong place?). I have made a guess how to fix everything below:

[splunk_web_access]
LOOKUP-AD = AD_User_List user AS cn OUTPUTNEW UserFullName AS FullName
[source::/opt/splunk/var/log/splunk/web_access.log]
LOOKUP-Lookup-AD_Source_Attempt = AD_User_List user AS cn OUTPUTNEW UserFullName AS FullName
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Automatic looks on _internal are working fine for me. Post your props.conf so we can take a look.

0 Karma

jarrex
Explorer

bash-4.1$ cat props.conf
[_internal]

[splunkd*]

[splunk_web_access]
LOOKUP-AD = AD_User_List cn AS user OUTPUTNEW FullName AS UserFullName

[source::/opt/splunk/var/log/splunk/web_access.log]
LOOKUP-Lookup-AD Source Attempt = AD_User_List cn AS user OUTPUTNEW FullName AS UserFullName
bash-4.1$

0 Karma

jarrex
Explorer

It should probably also be noted that there are 2 doing the same query because I wasn't sure if there was an issue with the sourcetype. It did this back when I just was trying it on splunk_web_access

0 Karma

lguinn2
Legend

What sourcetype and fields are you using for the lookups?

0 Karma

jarrex
Explorer

I am using the user field and the sourcetype of splunk_web_access

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...