topic Re: Lookups with backslash in key in Splunk Search

Lookups with backslash in key

JensT — Sat, 22 Mar 2014 12:16:23 GMT

Hi,

We're analazing database logs. From SyBase, Oracle and MSSQL.

MSSQL full db instances contain a \

e.g. MSNG123\MyInstance

We want to use a lookup to enrich the data.

It works fine with the lookup command. But not using the automatic lookup.

Any suggestions?

Using Splunk 4.3.6

Regards,

Jens

Re: Lookups with backslash in key

MuS — Mon, 24 Mar 2014 08:28:23 GMT

Hi JensT,

to make it short, this works as well with the automatic lookup. I did a quick test on VERSION=4.3.6 BUILD=153775 PRODUCT=splunk PLATFORM=Linux-x86_64 with a lookup file containing the following data:

host,database
myhost,"foo\myDB"
#myhost,bar\\yourDB
#myhost,'bar\yourDB'
#myhost,baryourDB

I did setup an automatic lookup for sourcetype, source and host and all three of them were working. I was able to get back database values like foo\myDB or 'bar\yourDB'

I think the problem is, that either the sourcetype, source or host name do not match. For example automatic lookup in my test for sourcetype=* did not work, but with sourcetype=splunkd_access it worked.

I did use a run everywhere search like this: index=_internal | head 1 | table host database which will return one event of sourcetype=splunkd_access and this was my test automatic lookup in props.conf:

[splunkd_access]
LOOKUP-mydb = mydatabase host AS host OUTPUTNEW database AS database

and the result will be this:

hope this helps ...

cheers, MuS

PS: Grüsse aus Basel 😉

Re: Lookups with backslash in key

JensT — Mon, 24 Mar 2014 08:52:26 GMT

Hi!

i retested and you are absolutely right!

1.) \ in any lookup is not a problem.

2.) Its MSSQL not MSSSQL

Thanks,

Jens