topic automatic lookups in Splunk Search

automatic lookups

friskyapple — Fri, 21 Aug 2020 01:26:27 GMT

I've got 3 automatic lookups:

host::ORAC : LOOKUP-game title	game_titles id AS title_id OUTPUTNEW publisher_id AS publisher_id title AS game_title
host::ORAC : LOOKUP-game title id	Games id AS game_id OUTPUTNEW title_id AS title_id
host::ORAC : LOOKUP-publisher name	publishers id AS publisher_id OUTPUTNEW name AS publisher

the title id one works fine, but the other two, which are based on the generated field from the automated lookup don't cause an error but don't create any new fields either. Are we not able to use fields created by the automatic lookup for further lookups?

Re: automatic lookups

yeahnah — Fri, 21 Aug 2020 06:40:47 GMT

Hi @friskyapple

You are right and you're not able to use automatic lookups chained to further lookups, as an automatic lookup occurs at search time, i.e. the lookup field must exist in the results of your base search.

https://docs.splunk.com/Documentation/Splunk/8.0.5/Knowledge/Aboutlookupsandfieldactions#Automatic_lookups

Couple of possible options:

1. Add the subsequent "lookup" commands into your search query, i.e. run manually

2. Create a new lookup that combines the 3 lookup files into 1 new lookup

Would depend on your use case what works best.

Hope this helps.

Re: automatic lookups

thambisetty — Fri, 21 Aug 2020 07:20:09 GMT

One last option you have to name your lookup definitions in the ASCII order they want to be executed. Not tested though.

for example:

host::oracle-1 # this will be executed first

host::oracle-2 # this will be executed next