topic Re: want to create a global field for an indexed data using automatic lookup in Knowledge Management

How to create a global field for an indexed data using automatic lookup?

sushree1234 — Sun, 04 Sep 2022 22:19:56 GMT

Hi All ,

So i was trying to create an global field for a newly indexed data , so trying out with automatic lookup settings .
Ex- in the indexed data - datacenter name is not mentioned , so wanted to populate it using automatic lookup . I am able to do that , but for only 1 sourcetype , i have 100+ sourcetypes , is there any way to define apply to - sourcetype/hosts to multiple one . Please let me know .

Re: want to create a global field for an indexed data using automatic lookup

m_pham — Sat, 03 Sep 2022 07:31:34 GMT

Take a look at doing that in props.conf:

https://docs.splunk.com/Documentation/SplunkCloud/latest/Knowledge/Makeyourlookupautomatic#Create_an_automatic_lookup_stanza_in_props.conf

Re: want to create a global field for an indexed data using automatic lookup

PickleRick — Sat, 03 Sep 2022 14:48:28 GMT

https://docs.splunk.com/Documentation/Splunk/latest/Admin/propsconf

[<spec>] * This stanza enables properties for a given <spec>. * A props.conf file can contain multiple stanzas for any number of different <spec>. * Follow this stanza name with any number of the following setting/value pairs, as appropriate for what you want to do. * If you do not set a setting for a given <spec>, the default is used. <spec> can be: 1. <sourcetype>, the source type of an event. 2. host::<host>, where <host> is the host, or host-matching pattern, for an event. 3. source::<source>, where <source> is the source, or source-matching pattern, for an event. 4. rule::<rulename>, where <rulename> is a unique name of a source type classification rule. 5. delayedrule::<rulename>, where <rulename> is a unique name of a delayed source type classification rule. These are only considered as a last resort before generating a new source type based on the source seen. **[<spec>] stanza precedence:** For settings that are specified in multiple categories of matching [<spec>] stanzas, [host::<host>] settings override [<sourcetype>] settings. Additionally, [source::<source>] settings override both [host::<host>] and [<sourcetype>] settings.

Re: want to create a global field for an indexed data using automatic lookup

sushree1234 — Tue, 06 Sep 2022 10:44:14 GMT

can i get a example for props.conf & transforms.conf for multiple host automatic lookup setup