https://community.splunk.com/t5/Splunk-Search/how-to-perform-lookups-on-summary-index-data/m-p/22537#M3893 <P>option #1 worked, nice that you can call the lookup on demand. thanks very much!</P> Tue, 10 Apr 2012 21:23:00 GMT sonicZ 2012-04-10T21:23:00Z https://community.splunk.com/t5/Splunk-Search/how-to-perform-lookups-on-summary-index-data/m-p/22535#M3891 <P>I have a lookup on sourcetype=vipservices<BR /> csv file has values like so</P> <P>jurhash, jurhasfriendlyname<BR /> somehashvalue, somehashvalue_friendly_name</P> <P>Works fine when i am running the lookup on the sourcetype, but when i populate a summary index and try to use the lookup the sourcetype gets renamed to "Stash". </P> <P>What's the best way to preserve sourcetype or reference original sourcetype for the existing lookup to use against the summary index? <BR /> Any other workarounds would work also</P> <P>Thanks</P> Mon, 28 Sep 2020 11:39:03 GMT https://community.splunk.com/t5/Splunk-Search/how-to-perform-lookups-on-summary-index-data/m-p/22535#M3891 sonicZ 2020-09-28T11:39:03Z https://community.splunk.com/t5/Splunk-Search/how-to-perform-lookups-on-summary-index-data/m-p/22536#M3892 <P>I've given a couple of options below, but I do have a question: what does your populating search look like? I assumed that you were using sistats ...</P> <P>Option 1 - you could use the lookup command when you retrieve the data from the summary index</P> <PRE><CODE>index=yoursummaryindex saved_search=yoursavedsearch | lookup yourlookupname jurhash OUTPUT juhasfriendlyname | ... whatever you want to get out ... </CODE></PRE> <P>Option 2 - put the lookup into the populating search (which I called <CODE>yoursavedsearch</CODE> in option 1):</P> <PRE><CODE>sourcetype=vipservices | sistats whateverstats by whateverfields jushasfriendlyname </CODE></PRE> <P>and then the <CODE>juhasfriendlyname</CODE> will be stored, like any other field, in the summary index. You will not need to do the lookup when you retrieve the data from the summary index.</P> Tue, 10 Apr 2012 17:18:00 GMT https://community.splunk.com/t5/Splunk-Search/how-to-perform-lookups-on-summary-index-data/m-p/22536#M3892 lguinn2 2012-04-10T17:18:00Z https://community.splunk.com/t5/Splunk-Search/how-to-perform-lookups-on-summary-index-data/m-p/22537#M3893 <P>option #1 worked, nice that you can call the lookup on demand. thanks very much!</P> Tue, 10 Apr 2012 21:23:00 GMT https://community.splunk.com/t5/Splunk-Search/how-to-perform-lookups-on-summary-index-data/m-p/22537#M3893 sonicZ 2012-04-10T21:23:00Z https://community.splunk.com/t5/Splunk-Search/how-to-perform-lookups-on-summary-index-data/m-p/22538#M3894 <P>Our populating search was this btw:</P> <PRE><CODE>index="vip" sourcetype=vipservices | transaction TR startswith="Operation Start" endswith="Operation End" | eval elapsed_wait=elapsed_operation-elapsed_request | sistats count, avg(elapsed_operation) as total-avg, perc80(elapsed_operation) as total-80, perc90(elapsed_operation) as total-90, perc95(elapsed_operation) as total-95, perc98(elapsed_operation) as total-98, perc99(elapsed_operation) as total-99,max(elapsed_operation) as total-max, avg(elapsed_responder) as resp-avg, max(elapsed_responder) as resp-max, avg(elapsed_request) as req-avg, max(elapsed_request) as req-max, avg(elapsed_wait) as wait-avg, max(elapsed_wait) as wait-max by host, JURHASH, OP </CODE></PRE> Tue, 10 Apr 2012 21:25:43 GMT https://community.splunk.com/t5/Splunk-Search/how-to-perform-lookups-on-summary-index-data/m-p/22538#M3894 sonicZ 2012-04-10T21:25:43Z