topic Re: How do you create a static table for a lookup file? in Splunk Search

How do you create a static table for a lookup file?

_smp_ — Fri, 09 Nov 2018 14:34:58 GMT

I have kind of a silly question that I am embarrassed to admit has stumped me for a little while.

I have a small list of server IP addresses and names that I would like to put in a lookup table file. I could easily create this file outside of Splunk, but I would prefer to construct a Splunk search to ensure it is built in a consistent way. So I am trying to construct a search which builds a table of static values and pipes the output to '|outputlookup' generate the lookup file. But I can't seem to find the right syntax to build a simple table with a name and IP column. I've tried various combinations of eval, append, appendpipe and I just can't seem to find the right syntax. The table is very simple:

name,ip
server1,ip1
server2,ip2
server3,ip3

Re: How do you create a static table for a lookup file?

kmaron — Fri, 09 Nov 2018 14:45:30 GMT

This should get you what you want

| makeresults 
| eval name="server1" 
| eval ip="ip1" 
| append 
    [| makeresults 
    | eval name="server2" 
    | eval ip="ip2"] 
| append 
    [| makeresults 
    | eval name="server3" 
    | eval ip="ip3"] 
| fields - _time | outputlookup filename

Re: How do you create a static table for a lookup file?

_smp_ — Fri, 09 Nov 2018 14:57:00 GMT

sigh

That's why I was embarrassed. I knew it would be simple. Thanks!!

Re: How do you create a static table for a lookup file?

kmaron — Fri, 09 Nov 2018 15:01:00 GMT

eh no need to be embarrassed. I wasn't sure I remembered how to do it 🙂