topic Re: Lookups with a python script in Getting Data In

Lookups with a python script

Marinus — Wed, 07 Apr 2010 02:27:34 GMT

The transforms spec indicated that you can do a lookup using a python script. Do you have an example?

Re: Lookups with a python script

gkanapathy — Wed, 07 Apr 2010 05:17:05 GMT

There is an example in $SPLUNK_HOME/etc/system/bin/external_lookup.py.

Re: Lookups with a python script

Marinus — Wed, 07 Apr 2010 15:08:21 GMT

Thanks Gerald, do you have an example if you want to return more than one field based on your lookup?

Re: Lookups with a python script

gkanapathy — Thu, 08 Apr 2010 00:18:21 GMT

Not really, but it's the same. All you do is add another column to the output CSV and add the extra field in the appropriate places in the configuration. Basically, Splunk passes a CSV file in to the script, with lookup values in the input columns/fields and null values in the output columns/fields, and your script should write out a CSV with all the fields filled in.

Re: Lookups with a python script

Lowell — Wed, 26 May 2010 02:47:19 GMT

For anyone interested in a database lookup script example, I have posted one here:

I want sample code to connect to Oracle database, and lookup a table at search time

Re: Lookups with a python script

bansi — Mon, 20 Dec 2010 23:11:30 GMT

I think if someone has already developed similar article to connect to DB2 database and lookup table at search time then please publish it otherwise i am working on it and will be glad to publish it if i get little help from Splunk Forums on how to integrate my working copy under Python 2.7 with Splunk Python 2.6