Splunk Search

Using extracted fields in automatic lookups

joshua_hart
Explorer

I have a series of fields I've extracted using the GUI for a particular sourcetype. I've also set up a lookup table, definition, and automatic lookup using one of those fields. The automatic lookup is supposed to add a field from the lookup table. However, I cannot get it to work with fields that have been extracted using the GUI. Is there something I'm missing? Automatic lookups work just fine on sourcetypes with fields that have been automatically extracted (ie, they arrive at Splunk as "key=value" pairs and require no additional extraction).

Any hints?

0 Karma

davecroto
Splunk Employee
Splunk Employee

First add an entry in $SPLUNK_HOME/etc/systems/local/transforms.conf:

[alookupexample]
filename=mycsvfile.csv

Then either restart splund or do a | extract reload=t then run a search like the one below:

somesearch | lookup alookupexample <oneofthefieldsyouextractedviagui> OUTPUT <oneofthefieldsinthelookup)in_the_lookup>

oneofthefieldsyouextractedviagui above needs to be the first column of the csv lookup

make sure you are looking at all the interesting fields on the right (blue) of the screen

After you've confirmed that that works put in the correct stanza inside of the props.conf file.

joshua_hart1
Path Finder

So, I ran the search manually with the lookup and I was able to match fields in the search with fields in the lookup, but the OUTPUT field was not...output. No dice. But, thanks.

0 Karma

lukejadamec
Super Champion

search | extract | lookup

0 Karma

lukejadamec
Super Champion

Have you tested the lookup by applying it manually after a search that extracts the fields?

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...