How to use a lookup table in a Splunk query?

abhi04 — Wed, 16 May 2018 15:31:46 GMT

I have a lookup excel sheet with the application name, hostname, and IP address. I want to use it in a Splunk query and how shall I do it?

Re: How to use a lookup table in a Splunk query?

xpac — Wed, 16 May 2018 15:51:29 GMT

You wanna read this chapter of the docs.

Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂

Re: How to use a lookup table in a Splunk query?

ChrisG — Wed, 16 May 2018 17:03:00 GMT

I suggest you go through the Search Tutorial from the beginning. It includes a step for enriching data with a CSV lookup file.

Re: How to use a lookup table in a Splunk query?

elliotproebstel — Wed, 16 May 2018 17:03:07 GMT

You should save your excel spreadsheet as a csv (comma-separated values) file, making sure to follow these guidelines:

The table in the CSV file should have at least two columns. One column represents a field with a set of values that includes values belonging to a field in your events. The column does not have to have the same name as the event field. Any column can have multiple instances of the same value, which is a multivalued field.
The characters in the CSV file must be plain ASCII text and valid UTF-8 characters. Non-UTF-8 characters are not supported.
CSV files cannot have "\r" line endings (OSX 9 or earlier)
CSV files cannot have header rows that exceed 4096 characters.

Source: http://docs.splunk.com/Documentation/Splunk/7.1.0/Knowledge/Usefieldlookupstoaddinformationtoyourevents

Next, you'll need to upload the csv file to Splunk. You can do this by following these steps:

Select Settings > Lookups to go to the Lookups manager page.
In the Actions column, click Add new next to Lookup table files.
Select a Destination app from the list. Your lookup table file is saved in the directory where the application resides. For example: $SPLUNK_HOME/etc/users///lookups/.
Click Choose File to look for the CSV file to upload.
Enter the destination filename. This is the name the lookup table file will have on the Splunk server. If you are uploading a gzipped CSV file, enter a filename ending in ".gz". If you are uploading a plaintext CSV file, use a filename ending in ".csv".
Click Save.

Source: http://docs.splunk.com/Documentation/Splunk/7.1.0/Knowledge/Usefieldlookupstoaddinformationtoyourevents#Upload_the_lookup_table_file

After the file is in Splunk, you should create a lookup definition. The details for that are here:
http://docs.splunk.com/Documentation/Splunk/7.1.0/Knowledge/Usefieldlookupstoaddinformationtoyourevents#Create_a_CSV_lookup_definition

Once the lookup is properly defined, you can use these commands for interacting with it:
lookup - to consult the contents of the lookup file and use fields from the lookup to enrich your event data
inputlookup - to display the contents of the lookup file
outputlookup - to append to the lookup file or replace its contents entirely

topic Re: How to use a lookup table in a Splunk query? in Splunk Search

How to use a lookup table in a Splunk query?

Re: How to use a lookup table in a Splunk query?

Re: How to use a lookup table in a Splunk query?

Re: How to use a lookup table in a Splunk query?