topic Re: lookup against an extracted field in Splunk Search

lookup against an extracted field

vbumgarner — Wed, 01 Dec 2010 08:14:37 GMT

Is it possible to have a lookup table keyed off of an extracted field?

Given the props:

[foo]
EXTRACT-bu = ^(?<bu>.{5})\- in host
LOOKUP-bu = bu_fields bu

and the transforms:

[bu_fields]
filename = buFields.csv

Should this work?

I believe the lookuptable is there, because this works as expected:

sourcetype="foo" | lookup bu_fields bu

Re: lookup against an extracted field

gkanapathy — Wed, 01 Dec 2010 11:11:06 GMT

Yes of course. In fact almost all fields are extracted, so this is what lookups normally do. Generally, the order at search time is:

KV_MODE
EXTRACT
REPORT
FIELDALIAS
LOOKUP

Re: lookup against an extracted field

vbumgarn — Wed, 01 Dec 2010 12:21:08 GMT

Yeah, I've made it work with another test, so something is weird in that config.

Looks like I'll need to make an indexed field out of bu if I want to search against the fields in the lookup, though.

Re: lookup against an extracted field

gkanapathy — Wed, 01 Dec 2010 12:59:27 GMT

well, actually, are you trying to do a reverse lookup? that won't work if the extracted value is not from the _raw field, and yours is from host. the forward lookup should work okay though. You can make it work with much-diminished performance by setting INDEXED_VALUE = false in fields.conf for the bu field.

Re: lookup against an extracted field

gkanapathy — Wed, 01 Dec 2010 13:00:47 GMT

or by using where or search after the initial search, or by creating an indexed field.

Re: lookup against an extracted field

vbumgarner — Wed, 01 Dec 2010 14:00:20 GMT

I think an indexed field is the answer in this case.

Re: lookup against an extracted field

bwooden — Thu, 12 Sep 2013 18:21:50 GMT

This answer was written before calculated fields. Now that we have calculated fields: 4.5 = EVAL (calculated fields)