topic Re: difference betwen output and outputnew in splunk lookup in Splunk Search

difference betwen output and outputnew in splunk lookup

splunkn — Mon, 28 Sep 2020 17:30:08 GMT

Could anyone please let me clear with the following basic questions?
1. What is the difference between output and outputnew in lookup?
2. lookup status_desc status OUTPUT description
Here status represent the field in events?
description is the new field going to be add based on status rite?

And Im getting the following error while Im working with lookup
"Could not find all of the specified destination fiels in the lookup table for conf '(?::){0}PerfmonMk*:*' and lookup table test_lkup"

And initially I haven't give global permission to lookup. Will it cause any issue?
Now I have removed all the things. Eventhough Im getting the error ??

props.conf
[default]
LOOKUP-test_lkup = test_lkup sourcetype OUTPUT flag

transforms.conf
[test_lkup]
filename = test_lkup.csv

test_lkup.csv
sourcetype,flag
A,true
B,true
C,true

Thanks in advance.

Re: difference betwen output and outputnew in splunk lookup

aweitzman — Fri, 05 Sep 2014 12:53:01 GMT

The answer to your two numbered questions is: Yes, stats represents the field in the event, and description will be the new field generated. The difference between OUTPUT and OUTPUTNEW is if the description field already exists in your event, OUTPUT will overwrite it and OUTPUTNEW won't.

As for the rest of it, my recommendations would be:

Give global permission to everything first, get everything to work, and then change the permissions and see what breaks.
Make sure that default is a valid sourcetype in your data (if it's a host, source or rule, the syntax is different, check http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf for details).
I wonder whether the name LOOKUP-test_lkup is confusing things. The string after LOOKUP- is supposed to be a unique literal, and test_lkup is used elsewhere for other things. Try LOOKUP-random and see whether that helps.

Good luck.