topic Re: Lookup Table for all Sourcetype in Splunk Search

Lookup Table for all Sourcetype

marendra — Wed, 18 May 2011 03:04:14 GMT

Hi All,

Quick question, in Manager » Lookups » Automatic lookups » Add New
on Apply to drop down box, we can select from SOurcetype, source, or host.
If I choose any of the choices, can I put * on the sourcetype field. The reason is the lookup table that I created meant for any sourcetype, and any host those are currently indexed by my SPlunk.
I tried before it wouldn't do the trick. If possible, do I need to put other character value?

Please advise on this

Thanks

Re: Lookup Table for all Sourcetype

hazekamp — Wed, 18 May 2011 03:41:09 GMT

The UI will create a stanza which did not work in my testing.

## props.conf
[*]
LOOKUP-all_test = my_test_lookup sourcetype OUTPUTNEW foo

If you want this lookup to be global I would recommend specifying this property in props.conf without a stanza:

## props.conf
LOOKUP-all_test = my_test_lookup sourcetype OUTPUTNEW foo

Based on a similar Q/A it is also possible use wildcards in sourcetype for props.conf if you don't want to make the lookup global: wildcards in sourcetypes.conf

Re: Lookup Table for all Sourcetype

marendra — Wed, 18 May 2011 07:36:20 GMT

Thanks It works. Just delete the [*] and put on top of the props.conf.

Thanks again

Re: Lookup Table for all Sourcetype

gfriedmann — Thu, 23 Jun 2011 22:43:08 GMT

A cleaner method may be using [host:*] stanza header.

Re: Lookup Table for all Sourcetype

ASealey_Nike — Tue, 13 Aug 2013 18:46:46 GMT

I also accomplished similar using [default] as the stanza header.

Re: Lookup Table for all Sourcetype

NeerajDhapola7 — Fri, 28 Apr 2017 22:45:13 GMT

Just need to select HOST as Apply To and * in named field as below while
Lookups » Automatic lookups » Add new

No need to edit Props.conf gile

Thanks
Neeraj Singh Dhapola