I would like to record a user's department at the time of the event rather than search time. I have username => department in a lookup table.
Conceptually, at index time, I would like a new field (eg "department") to be populated with the result of
[ lookup user username OUTPUT department ]
(How )can I do this?
You can't so don't even try. Instead, use a time-based lookup:
http://docs.splunk.com/Documentation/Splunk/6.6.1/Knowledge/Configureatime-boundedlookup
Then you do the lookup with _time
for every event and aggregate afterwards. Obviously, you cannot use tstats
but other than that, this should be fine.
If you absolutely have to do this, you would create a Summary Index
this as a separate data source and do your own search-based merging.
You can't so don't even try. Instead, use a time-based lookup:
http://docs.splunk.com/Documentation/Splunk/6.6.1/Knowledge/Configureatime-boundedlookup
Then you do the lookup with _time
for every event and aggregate afterwards. Obviously, you cannot use tstats
but other than that, this should be fine.
If you absolutely have to do this, you would create a Summary Index
this as a separate data source and do your own search-based merging.
Thanks, I'll give that a try 🙂
Use of lookup table at index time is not possible. The closest you can get to correctly identify the department of the user based on the time of indexing (as user may switch departments), will be to setup time-based lookup. See this for more information.
http://docs.splunk.com/Documentation/Splunk/6.6.1/Knowledge/Configureatime-boundedlookup