topic Re: How can I use lookup csv from another Index? in Splunk Search

How can I use lookup csv from another Index?

arusoft — Thu, 08 Apr 2021 20:25:40 GMT

How can I use lookup csv from another Index? I have access to both index.

Thanks.

Re: How can I use lookup csv from another Index?

gcusello — Fri, 09 Apr 2021 09:23:29 GMT

Hi @arusoft,

what do you mean with lookup from another index?

lookups aren't related to index!

if you're speaking of a lookup of another app, you have only to define the app and the app definition as global.

could you better describe your question?

Ciao.

Giuseppe

Re: How can I use lookup csv from another Index?

arusoft — Fri, 09 Apr 2021 13:35:20 GMT

Sorry, by index I meant App.

So when I logged into an App and I run this command | inputlookup my_lookup.csv I get the results.

But when I run the same command for same lookup in another app (for which I have power user access), I don't get results. So wondering is there something I can do in query to get results from lookup of another app.

Thank You.

Re: How can I use lookup csv from another Index?

aasabatini — Fri, 09 Apr 2021 15:09:19 GMT

Hi @arusoft

@gcusello replied to you to define the app and the app definition as global.

go to settings and lookup

select global on sharing

Re: How can I use lookup csv from another Index?

gcusello — Fri, 09 Apr 2021 15:10:18 GMT

Hi @arusoft,

you have to give to your Lookup and Lookup Definition (remember of it otherwise it doesn't run!) a Global sharing and you'll see it in all your apps.

Ciao.

Giuseppe

Re: How can I use lookup csv from another Index?

arusoft — Fri, 09 Apr 2021 15:14:55 GMT

So there is no way to access lookup of another app even though I have access to that App?

I was hoping since I have access I should somehow qualify a lookup with app name and able to view them. The reason I am saying this is because I don't have access to make changes to that lookup. I have permission only to view that lookup.

Regards.

Re: How can I use lookup csv from another Index?

gcusello — Fri, 09 Apr 2021 15:25:58 GMT

Hi @arusoft,

You can view the content of a lookup:

in every app, if it's shared a Global level,
in its own app, if it's shared at App level.

No other ways.

If you can access the lookup in the app, you could export the content in your pc and upload it in your own version of the lookup, but ot's only manual.

Ciao.

Giuseppe

Re: How can I use lookup csv from another Index?

arusoft — Fri, 09 Apr 2021 15:29:19 GMT

Thank you again. So looks like not possible without having its access changed to Global level. This is what I was trying to find. My goal was to view it without making any changes.

Regards.

Re: How can I use lookup csv from another Index?

gcusello — Fri, 09 Apr 2021 15:31:37 GMT

Hi @arusoft,

sorry, no other way!

If this answer solves your need, please accept it for the other people of Community.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉