topic Re: How to get a field from a lookup in Splunk Search

How to get a field from a lookup

proylea — Thu, 04 Aug 2016 05:15:03 GMT

ok, here is my dilemma

I have a lookup table like this:

_raw,sourcetype,alertMessage,severity
 *Reloading repositories*,liferay,Reloading repositories,high
 *RememberMe*,liferay,Remember Me,low

When I do a search like this:

index=pre_ces [|inputlookup pre-ces-alerts.csv | return 100 $_raw ]

I get the correct number of results returned for the 2 strings in _raw in the lookup, so all good.

Now I would like to apply the lookup field called alertMessages to the matching _raw events.

I thought maybe something like this:

index=pre_ces [|inputlookup pre-ces-alerts.csv | return 100 $_raw ]| lookup update=true pre-ces-alerts.csv _raw OUTPUT alertMessage

but it's doesn't create the field alertMessages

If I select sourcetype as the lookup field like this:

index=pre_ces [|inputlookup pre-ces-alerts.csv | return 100 $_raw ]| lookup update=true pre-ces-alerts.csv sourcetype OUTPUT alertMessage

I get the alertMessage as an interesting field but both of the alertMessage strings get applied to every event because their sourcetype is the same.

What I suspect is that because my _raw lookup string is not an exact match to the _raw event field (albeit a wild card match) it doesn't apply the alertMessage field.

Can anyone tell me what I am missing here?

Kind Regards
Peter

Re: How to get a field from a lookup

teunlaan — Thu, 04 Aug 2016 08:29:11 GMT

Think your missing the format command.

http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Format

Re: How to get a field from a lookup

proylea — Fri, 05 Aug 2016 00:59:01 GMT

Thanks, but I have used the return command specifically because the format command was not returning the result correctly.

I am getting the correct number of results returned I am just unable to apply the alertMessage field from the lookup to the corresponding _raw events

Re: How to get a field from a lookup

MuS — Fri, 05 Aug 2016 01:26:40 GMT

Hi proylea,

your using *RememberMe* and another wild card field in the lookup; did you configure the lookup to use match_type = WILDCARD(fieldname) in transforms.conf? The default for lookups is match_type = EXACT - see the docs for more details http://docs.splunk.com/Documentation/Splunk/6.4.2/Admin/Transformsconf

Hope this helps ...

cheers, MuS

Re: How to get a field from a lookup

proylea — Fri, 05 Aug 2016 01:47:03 GMT

Thanks MuS
I think that is my missing piece.
This is a Splunk cloud environment, can I make that change in the UI or do I need to pass a transforms.conf to the cloud team?

Re: How to get a field from a lookup

MuS — Fri, 05 Aug 2016 02:04:46 GMT

No UI access to any transforms.conf in cloud 😞 So, you need to pass it to the cloud ops ...

Re: How to get a field from a lookup

proylea — Fri, 05 Aug 2016 02:17:00 GMT

Thanks MuS you're a legend

Re: How to get a field from a lookup

MuS — Fri, 05 Aug 2016 03:33:11 GMT

blush thanks 🙂