topic Re: How to have lookup iplocation fields added to all events at index time? in Splunk Search

How to have lookup iplocation fields added to all events at index time?

dmcbray — Thu, 04 Aug 2016 02:14:54 GMT

I would like to have iplocation fields added to all events when they're ingested and have verified the lookup works in the search app. I've done something similar with dnsLookups in props.conf, but doing the same for iplocation doesn't appear to function the same. Here's what I've tried in my props.conf:

LOOKUP-iplocation_src = iplocation prefix=src_ allfields=true srcip 
LOOKUP-iplocation_dst = iplocation prefix=dst_ allfields=true dstip

With that I get: The lookup table 'iplocation' does not exist. when searching. Do I need to reference the iplocation lookup in my transforms.conf?

Thanks.

Re: How to have lookup iplocation fields added to all events at index time?

dshpritz — Thu, 04 Aug 2016 02:19:22 GMT

Just a note that lookups don't occur on indexing. They occur on search. This means that if you configure iplocation as an automatic lookup, then when a user searches the data, the iplocation will occur, which may have some search performance implications.

Re: How to have lookup iplocation fields added to all events at index time?

somesoni2 — Thu, 04 Aug 2016 03:12:08 GMT

The dnsLookup is an external lookup hence you're able to setup search time (as mentioned by @dshpritz) automatic lookup for it.
The iplocation is a custom search command hence it's not available as the automatic lookup.

You can see the difference in the way both are invoked in search

base search | lookup dnsLookup ip as clientip OUTPUT host

base search | iplocation clientip

Re: How to have lookup iplocation fields added to all events at index time?

dmcbray — Thu, 04 Aug 2016 18:23:57 GMT

Thanks @dshpritz & @somesoni2. I do see the difference between the two, but was hoping there was something I was missing that would make it work. I also wasn't aware the automatic lookups didn't add the fields at indexing. The goal was to spread the load of those lookups over time instead of a massive amount of lookups at search time.