https://community.splunk.com/t5/Splunk-Dev/Scripted-Lookup-Output-and-Configuring-in-Splunk/m-p/55341#M705 <P>Hi all,</P> <P>Everyone in my organization has a unique username, which I have extracted from my search as "anumber".<BR /> I want to construct an external lookup script to convert this "anumber" extraction into human names.</P> <P>All of these anumbers are convertible via an AD lookup, which I have scripted.</P> <P>This is basically what I want to achieve, in my fields I want to be able to see both anumber and humanname, for example:</P> <PRE><CODE>anumber = "a00001" humanname = "Michael Someone" </CODE></PRE> <P>I have written a python script which works as follows...</P> <PRE><CODE>./a0convert.py a00001 </CODE></PRE> <P>Returns:</P> <PRE><CODE>Someone, Michael </CODE></PRE> <P>Now, two questions...</P> <P>1) Is this script output okay, or does it need to be formatted differently...?</P> <P>2) How do I now add this scripted lookup into splunk? (preferably with the GUI, what needs to be done under "Lookups")</P> <P>Thanks in advance for any help you can provide.</P> <P>Aaron.</P> Mon, 10 Sep 2012 05:11:10 GMT aaronnicoli 2012-09-10T05:11:10Z https://community.splunk.com/t5/Splunk-Dev/Scripted-Lookup-Output-and-Configuring-in-Splunk/m-p/55341#M705 <P>Hi all,</P> <P>Everyone in my organization has a unique username, which I have extracted from my search as "anumber".<BR /> I want to construct an external lookup script to convert this "anumber" extraction into human names.</P> <P>All of these anumbers are convertible via an AD lookup, which I have scripted.</P> <P>This is basically what I want to achieve, in my fields I want to be able to see both anumber and humanname, for example:</P> <PRE><CODE>anumber = "a00001" humanname = "Michael Someone" </CODE></PRE> <P>I have written a python script which works as follows...</P> <PRE><CODE>./a0convert.py a00001 </CODE></PRE> <P>Returns:</P> <PRE><CODE>Someone, Michael </CODE></PRE> <P>Now, two questions...</P> <P>1) Is this script output okay, or does it need to be formatted differently...?</P> <P>2) How do I now add this scripted lookup into splunk? (preferably with the GUI, what needs to be done under "Lookups")</P> <P>Thanks in advance for any help you can provide.</P> <P>Aaron.</P> Mon, 10 Sep 2012 05:11:10 GMT https://community.splunk.com/t5/Splunk-Dev/Scripted-Lookup-Output-and-Configuring-in-Splunk/m-p/55341#M705 aaronnicoli 2012-09-10T05:11:10Z https://community.splunk.com/t5/Splunk-Dev/Scripted-Lookup-Output-and-Configuring-in-Splunk/m-p/55342#M706 <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsfromexternaldatasources#Set_up_a_fields_lookup_based_on_an_external_command_or_script">Here</A> it tells you how to Set up fields lookup based on an external command or script and there is example script.</P> Mon, 10 Sep 2012 06:33:41 GMT https://community.splunk.com/t5/Splunk-Dev/Scripted-Lookup-Output-and-Configuring-in-Splunk/m-p/55342#M706 MarioM 2012-09-10T06:33:41Z