topic Re: Lookup Tables and Comments in Splunk Search

Lookup Tables and Comments

jchensor — Fri, 21 Oct 2011 18:36:51 GMT

I currently am using a lookup table to match Host Names with a "grouping" category. However, there are a ton of entries in there and the order I have them in the file isn't directly obvious, so to make it easier for me to search through and edit the file, I'd love it if I could add "comments" to the lookup file. Is this possible? Can we start lines with a ':' or a '#' character or something and cause that line to be ignored during the lookup process?

Re: Lookup Tables and Comments

Drainy — Fri, 21 Oct 2011 21:05:44 GMT

Well its a CSV so you can't comment it.
But, you could add a comment field and simply not reference it during the lookup process? That way it will idle there un-used

UPDATE:

One way could be,

host,ip,comment
BOB,127.0.0.1,danger danger!

But you could avoid referencing the comment field completely

Re: Lookup Tables and Comments

jchensor — Fri, 21 Oct 2011 21:23:44 GMT

Yeah, I was just thinking that a "generic" Host Name like "#comment#" that would never actually be the name of a machine could just be treated as a comment. I was hoping that maybe Splunk's lookup process would have its own construct built-in that ignored certain lines. But you're probably right in that it most likely wouldn't. ^_^

Re: Lookup Tables and Comments

Drainy — Fri, 21 Oct 2011 21:35:30 GMT

have a look at my updated answer for an example of another way to do it