topic Re: How to create a lookup table in Splunk Search

How to create a lookup table

ngox0061 — Wed, 23 Sep 2020 18:54:05 GMT

I'm new to Splunk and was wondering how to do a lookup table. So what i'm trying to get is something like a lookup of:

index=_internal* log_level=WARN OR log_level=ERR host=XPxx9* OR host=GPxx7* OR host=fsr*

but instead of listing like 30 of the host names with OR arguments, what's the ideal way to do it? can someone provide examples?

Re: How to create a lookup table

richgalloway — Wed, 23 Sep 2020 20:00:46 GMT

There are a few ways to create a lookup table, depending on your access.

Use the CLI to create a CSV file in an app's lookups directory
Use the Lookup File Editor app to create a new lookup
Go to Settings->Lookups and click "Add new" next to "Lookup table files". Then fill in the form and upload a file.
Create a search and save the results using the | outputlookup command.

Re: How to create a lookup table

ngox0061 — Wed, 23 Sep 2020 20:08:45 GMT

I will try and follow your directions and give it a shot. Thanks, richgalloway!

Re: How to create a lookup table

inventsekar — Wed, 23 Sep 2020 22:40:33 GMT

Hi @richgalloway ...

outputlookup // i got a simple issue, but, somehow i could not find the solution from my top of my mind.

lets say i already have a lookup created and working fine(by my old teammate). aftersometime i would like to know how the csv file gets created. when i went to settings-->lookup, i dont see which search query creates the csv file. i think a saved search only uses that outputlookup command and creates that csv file.

this far only my mind works and i am not sure how to proceed further. pls suggest. thanks.

(i have given around 300 karma points so far, received badge for that,.. maybe you also give karma points if a/any post helped you, thx)

Re: How to create a lookup table

richgalloway — Thu, 24 Sep 2020 14:31:38 GMT

When I suspect a lookup file is populated by a saved search, I use this CLI command to find it.

find /opt/splunk/etc/apps -name savedsearches.conf -print0 | xargs -r0 grep -i "outputlookup mylookup.csv"

Yes, I do give karma to good answers.

Re: How to create a lookup table

inventsekar — Thu, 24 Sep 2020 21:47:40 GMT

Hi @richgalloway .. that find command solution is very intelligent(far better than searching splunk settings and the 100 options 😉 )

>> Yes, I do give karma to good answers.

oops, my signature line is meant for all others/the recent day new members. Definitely not for you. in these 5 years i have seen your solutions and i can never say such karma points comments to You. thanks.

(i have given around 300 karma points so far, received badge for that,.. maybe you also should give karma points if a/any post helped you, thx)

Re: How to create a lookup table

richgalloway — Fri, 25 Sep 2020 12:33:53 GMT

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.