https://community.splunk.com/t5/Splunk-Search/Splunk-DB-Connect-Can-the-lookup-table-for-defining-extra-fields/m-p/148434#M185389 <P>I think that's correct... if you can take a bit of delay in recognizing the new schema, you can use the dblookup to regularly generate a new Splunk lookup.</P> Sat, 28 Mar 2015 21:23:20 GMT jcoates_splunk 2015-03-28T21:23:20Z https://community.splunk.com/t5/Splunk-Search/Splunk-DB-Connect-Can-the-lookup-table-for-defining-extra-fields/m-p/148433#M185388 <P>It seems that the lookup table for defining extra fields in datamodel can not be a dblookup (database lookup)? Can someone confirm this is the case and not a bug? </P> <P>The dblookup works fine in standalone search, but I am not able to make it to work in datamodel editor. </P> Mon, 23 Feb 2015 00:52:36 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-DB-Connect-Can-the-lookup-table-for-defining-extra-fields/m-p/148433#M185388 kundeng 2015-02-23T00:52:36Z https://community.splunk.com/t5/Splunk-Search/Splunk-DB-Connect-Can-the-lookup-table-for-defining-extra-fields/m-p/148434#M185389 <P>I think that's correct... if you can take a bit of delay in recognizing the new schema, you can use the dblookup to regularly generate a new Splunk lookup.</P> Sat, 28 Mar 2015 21:23:20 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-DB-Connect-Can-the-lookup-table-for-defining-extra-fields/m-p/148434#M185389 jcoates_splunk 2015-03-28T21:23:20Z https://community.splunk.com/t5/Splunk-Search/Splunk-DB-Connect-Can-the-lookup-table-for-defining-extra-fields/m-p/148435#M185390 <P>Could you pls elaborate more what do you mean by "you can use the dblookup to regularly generate a new Splunk lookup"? </P> Mon, 30 Mar 2015 15:53:39 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-DB-Connect-Can-the-lookup-table-for-defining-extra-fields/m-p/148435#M185390 sanjay_shrestha 2015-03-30T15:53:39Z https://community.splunk.com/t5/Splunk-Search/Splunk-DB-Connect-Can-the-lookup-table-for-defining-extra-fields/m-p/148436#M185391 <P>a saved search that looks something like this:<BR /> dblookup mydb "select * from mytable" | outputlookup mylookup<BR /> then you use mylookup in your searches </P> Mon, 30 Mar 2015 16:30:11 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-DB-Connect-Can-the-lookup-table-for-defining-extra-fields/m-p/148436#M185391 jcoates_splunk 2015-03-30T16:30:11Z https://community.splunk.com/t5/Splunk-Search/Splunk-DB-Connect-Can-the-lookup-table-for-defining-extra-fields/m-p/148437#M185392 <P>Did you mean |dbquery instead of |dblookup.<BR /> I was using |dbquery but the lookup file kept growing and its huge. To avoid this we also wanted to implement dblookup in datamodel.</P> Mon, 30 Mar 2015 16:36:58 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-DB-Connect-Can-the-lookup-table-for-defining-extra-fields/m-p/148437#M185392 sanjay_shrestha 2015-03-30T16:36:58Z https://community.splunk.com/t5/Splunk-Search/Splunk-DB-Connect-Can-the-lookup-table-for-defining-extra-fields/m-p/148438#M185393 <P>d'oh -- yes, that is what i meant... can you use a SQL limit to keep the size of your query down?</P> Mon, 30 Mar 2015 17:04:13 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-DB-Connect-Can-the-lookup-table-for-defining-extra-fields/m-p/148438#M185393 jcoates_splunk 2015-03-30T17:04:13Z https://community.splunk.com/t5/Splunk-Search/Splunk-DB-Connect-Can-the-lookup-table-for-defining-extra-fields/m-p/148439#M185394 <P>no as lookup can be done to any record for last one year.</P> Mon, 30 Mar 2015 18:05:35 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-DB-Connect-Can-the-lookup-table-for-defining-extra-fields/m-p/148439#M185394 sanjay_shrestha 2015-03-30T18:05:35Z https://community.splunk.com/t5/Splunk-Search/Splunk-DB-Connect-Can-the-lookup-table-for-defining-extra-fields/m-p/148440#M185395 <P>maybe it would work better to dbquery blah | dedup eventid | collect mysummary?</P> Mon, 30 Mar 2015 19:17:23 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-DB-Connect-Can-the-lookup-table-for-defining-extra-fields/m-p/148440#M185395 jcoates_splunk 2015-03-30T19:17:23Z https://community.splunk.com/t5/Splunk-Search/Splunk-DB-Connect-Can-the-lookup-table-for-defining-extra-fields/m-p/148441#M185396 <P>We thought about that but not preferable to create new summary index in this case.</P> Mon, 30 Mar 2015 19:53:36 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-DB-Connect-Can-the-lookup-table-for-defining-extra-fields/m-p/148441#M185396 sanjay_shrestha 2015-03-30T19:53:36Z