topic Re: How to use time-base-lookup? in Splunk Search

How to use time-base-lookup?

akanno — Mon, 28 Sep 2020 18:21:30 GMT

Hi,Splunk community.

I have a question about time-base-lookup.

I set following attribute to transforms.conf

[test]
collection = test
external_type = kvstore
fields_list = ip,unit,time
time_field = time
time_format = %d/%m/%y/%H

and I set following attribute to collections.conf.

[test]

Result of "| inputlookup test" is following.

ip time unit
192.168.150.81 09/12/14/18 B部
192.168.150.6 09/12/14/18 A部
192.168.150.81 09/12/14/17 D部
192.168.150.6 09/12/14/17 C部

I search by "index=test | lookup test ip".
However lookup does not work.

Why doesn't work?
Is there a way to solve?

Re: How to use time-base-lookup?

dolivasoh — Thu, 01 Jan 2015 02:54:36 GMT

You had it right with "| inputlookup test", just continue your search from there or use the lookup table as enrichment to indexed data. Lookups do no go in the index.

Re: How to use time-base-lookup?

akanno — Mon, 05 Jan 2015 02:08:29 GMT

Results when I search in "index=test | table _time,ip" are following.

results
_time ip
2014-12-09 18:00:01 192.168.150.81
2014-12-09 18:00:01 192.168.150.81
2014-12-09 18:00:01 192.168.150.6

If lookup correctly works , results when I search "index=test | lookup test ip | table _time,unit,ip" are like following.

results
_time unit ip
2014-12-09 18:00:01 B部 192.168.150.81
2014-12-09 18:00:01 B部 192.168.150.81
2014-12-09 18:00:01 A部 192.168.150.6

However , I don't get the above results.
why can't I get the above result?
Results I get are following

results
_time unit ip
2014-12-09 18:00:01 192.168.150.81
2014-12-09 18:00:01 192.168.150.81
2014-12-09 18:00:01 192.168.150.6

Re: How to use time-base-lookup?

dolivasoh — Mon, 28 Sep 2020 18:31:53 GMT

Try outputting the field you want from the lookup table, lookup {{table_name}} {{input_field}} output {{output_field}}

Re: How to use time-base-lookup?

akanno — Tue, 06 Jan 2015 00:44:15 GMT

dolivasoh,Thank you for your response.

I have tried outputting the field as "index=test | lookup test ip output unit | table _time,unit,ip".

However , I don't get "unit" field.