Splunk Search

If I have more than 1 lookup file with the same name, which file does Splunk pick up using inputlookup from the Search & Reporting app?

splunkrocks2014
Communicator

Assuming I have a lookup file, for instance, users.csv, with different contents and is located in different apps and shared globally. If I am running | inputlookup users.csv from "Search & Reporting", how does Splunk pick up the lookup file?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Have a look at how Splunk does the hierarchy of the configurations for app context here
http://docs.splunk.com/Documentation/Splunk/6.4.2/Admin/Wheretofindtheconfigurationfiles#Summary_of_...

Basically, local, app level sharing objects in current app will take preference over global objects in other apps.

$SPLUNK_HOME/etc/users/*

$SPLUNK_HOME/etc/apps/Current_running_app/local/*

$SPLUNK_HOME/etc/apps/Current_running_app/default/*

$SPLUNK_HOME/etc/apps/A/local/*, $SPLUNK_HOME/etc/apps/A/default/*, ... $SPLUNK_HOME/etc/apps/z/local/*, $SPLUNK_HOME/etc/apps/z/default/* (but see note below)

$SPLUNK_HOME/etc/system/local/*

$SPLUNK_HOME/etc/system/default/*

pradeepkumarg
Influencer

Ideally you cannot create an object with same name via Splunk Web when another object already exists with same name and is shared globally. We've seen Splunk Web erroring out. But Splunk won't stop you doing this when you migrate an app from different splunk instance on the file system. We knew this would cause conflicts and
unexpected results for the searches and manually took care of deleting/removingduplicate objects (macros, lookups ) when we migrated apps around. Having said that, I don't have answer on what happens when you try to inputlookup. May be app name comes into precedence? Depends on what app you are running your search from? Worth testing.

0 Karma

alexandermunce
Communicator

The stanza relating to a particular lookup table should be unique to avoid any issues as mentioned above.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...