topic Re: Automatic Lookups on Internal Index in Knowledge Management

Automatic Lookups on Internal Index

jarrex — Fri, 31 Jul 2015 17:58:37 GMT

Is the _internal index exempt from automatic lookups? I can't get any automatic lookups working on the index even with global permissions selected to work on the internal index, it works everywhere except there. Is there no way to do this?

Re: Automatic Lookups on Internal Index

lguinn2 — Fri, 31 Jul 2015 18:11:36 GMT

What sourcetype and fields are you using for the lookups?

Re: Automatic Lookups on Internal Index

jarrex — Tue, 29 Sep 2020 06:51:26 GMT

I am using the user field and the sourcetype of splunk_web_access

Re: Automatic Lookups on Internal Index

martin_mueller — Fri, 31 Jul 2015 18:17:34 GMT

Automatic looks on _internal are working fine for me. Post your props.conf so we can take a look.

Re: Automatic Lookups on Internal Index

jarrex — Tue, 29 Sep 2020 06:51:29 GMT

bash-4.1$ cat props.conf
[_internal]

[splunkd*]

[splunk_web_access]
LOOKUP-AD = AD_User_List cn AS user OUTPUTNEW FullName AS UserFullName

[source::/opt/splunk/var/log/splunk/web_access.log]
LOOKUP-Lookup-AD Source Attempt = AD_User_List cn AS user OUTPUTNEW FullName AS UserFullName
bash-4.1$

Re: Automatic Lookups on Internal Index

jarrex — Tue, 29 Sep 2020 06:51:32 GMT

It should probably also be noted that there are 2 doing the same query because I wasn't sure if there was an issue with the sourcetype. It did this back when I just was trying it on splunk_web_access

Re: Automatic Lookups on Internal Index

woodcock — Fri, 31 Jul 2015 19:10:57 GMT

You have 2 problems; first you are swapping the lookup name and event name positions and you have extra spaces in your LOOKUP- name (or perhaps it was supposed to be a second input field and you forgot to use AS and put it in the wrong place?). I have made a guess how to fix everything below:

[splunk_web_access]
LOOKUP-AD = AD_User_List user AS cn OUTPUTNEW UserFullName AS FullName
[source::/opt/splunk/var/log/splunk/web_access.log]
LOOKUP-Lookup-AD_Source_Attempt = AD_User_List user AS cn OUTPUTNEW UserFullName AS FullName