Splunk Search

lookup against an extracted field

vbumgarner
Contributor

Is it possible to have a lookup table keyed off of an extracted field?

Given the props:

[foo]
EXTRACT-bu = ^(?<bu>.{5})\- in host
LOOKUP-bu = bu_fields bu

and the transforms:

[bu_fields]
filename = buFields.csv

Should this work?

I believe the lookuptable is there, because this works as expected:

sourcetype="foo" | lookup bu_fields bu

gkanapathy
Splunk Employee
Splunk Employee

Yes of course. In fact almost all fields are extracted, so this is what lookups normally do. Generally, the order at search time is:

  1. KV_MODE
  2. EXTRACT
  3. REPORT
  4. FIELDALIAS
  5. LOOKUP

bwooden
Splunk Employee
Splunk Employee

This answer was written before calculated fields. Now that we have calculated fields: 4.5 = EVAL (calculated fields)

0 Karma

vbumgarner
Contributor

I think an indexed field is the answer in this case.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

or by using where or search after the initial search, or by creating an indexed field.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

well, actually, are you trying to do a reverse lookup? that won't work if the extracted value is not from the _raw field, and yours is from host. the forward lookup should work okay though. You can make it work with much-diminished performance by setting INDEXED_VALUE = false in fields.conf for the bu field.

0 Karma

vbumgarn
Path Finder

Yeah, I've made it work with another test, so something is weird in that config.

Looks like I'll need to make an indexed field out of bu if I want to search against the fields in the lookup, though.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...