topic Re: How do you search one lookup field and display another lookup field's information if a matching event occurs? in Splunk Search

How do you search one lookup field and display another lookup field's information if a matching event occurs?

N92 — Tue, 05 Feb 2019 16:41:23 GMT

For example, I have lookup xyz.csv with two fields, A and B.

I want to search for the value of A field. If any match occurs, then the value of the A and B field should be displayed with other information, which is available in raw logs.

Re: How do you search one lookup field and display another lookup field's information if a matching event occurs?

N92 — Tue, 05 Feb 2019 16:44:15 GMT

Re: How do you search one lookup field and display another lookup field's information if a matching event occurs?

chrisyounger — Tue, 05 Feb 2019 18:19:09 GMT

Yes it is possible to have lookups that use the field values from other lookups. Lookups run in sequence from their lexogrphical order. For example, the following will work:

props.conf

[my_sourcetype]
LOOKUP-a = lookup-a host OUTPUTNEW fielda fieldb
LOOKUP-b = lookup-b fielda OUTPUTNEW fieldc

Good luck

Re: How do you search one lookup field and display another lookup field's information if a matching event occurs?

woodcock — Tue, 05 Feb 2019 20:43:31 GMT

Like this:

index=YouShouldAlwaysSepcifyAnIndex AND sourcetype=AndSourcetypeToo AND [|inputlookup xyz.csv | table A]
| lookup xyz.csv A OUTPUT B

Re: How do you search one lookup field and display another lookup field's information if a matching event occurs?

xpac — Mon, 18 Feb 2019 14:56:08 GMT

As this is still a top result for this issue, I'd like to add:
In general, it works.
But - if a lookup is larger than the max_memtable_size in limits.conf (default: 10 MB), it will be indexed to disk. This seems to result in it being applied later - so if the lookup a in the above example is too big, this won't work anymore.
Raising the limit will fix the issue.
Thanks a ton to @starcher for pointing this out to me!

Re: How do you search one lookup field and display another lookup field's information if a matching event occurs?

chrisyounger — Mon, 18 Feb 2019 19:24:25 GMT

Wow that's interesting and something I didn't know either. Thanks for sharing.

Re: How do you search one lookup field and display another lookup field's information if a matching event occurs?

starcher — Tue, 29 Sep 2020 23:18:02 GMT

the auto lookup feature requires it to be in ram. So if over max_memtable_size it isn't. Normal lookup command in SPL will work. just not "autolookup" in props.

Re: How do you search one lookup field and display another lookup field's information if a matching event occurs?

xpac — Tue, 19 Feb 2019 17:39:09 GMT

So far I can not exactly confirm this. My "not in RAM" auto lookup works, but it seems to be applied AFTER the "in RAM" lookups. In my case, the latter depends on a field from the former, and therefore it fails.