topic Re: Acceleration - Search including lookup in Splunk Search

Acceleration - Search including lookup

HeinzWaescher — Thu, 20 Feb 2014 10:34:47 GMT

Hi,

I would like to use Report Acceleration. My search is using a lookupfile and this lookupfile is updated once a day. Will the acceleration write the summary before using the lookup? So that the search will always use the latest version/information of my lookupfile?

Heinz

Re: Acceleration - Search including lookup

DavidHourani — Thu, 20 Feb 2014 10:40:10 GMT

Hello Heinz,

If you create an Automatic lookup with your lookupfile the updated information will be accelerated when you modify your file.

Best regards,

David

Re: Acceleration - Search including lookup

HeinzWaescher — Mon, 28 Sep 2020 15:56:41 GMT

Hi,

I do it like this in the search string:

my search | lookup file.csv user_id OUTPUT last_activity |

The last_activity per user is written to the lookupfile each day at 00:00. So the last activity can change every time per user_id when the lookupfile is updated.

What I need is, that the latest last_activity is used for all former events per user_id, when I run the accelerated search.

Re: Acceleration - Search including lookup

DavidHourani — Fri, 21 Feb 2014 14:49:34 GMT

Hello again,

So your CSV file contains the last activity and the other info is from your search ?

Try using Automatic lookups instead of a lookup file that way you won't need to use the 'lookup' command but as far as Acceleration goes I think that once you accelerate a certain search, the results of the acceleration dont get modified over time unless you explicitly program schedule the search to run everyday after the lookupfile is re-written.

Best regards,
David