topic Re: Using extracted fields in automatic lookups in Splunk Search

Using extracted fields in automatic lookups

joshua_hart — Mon, 12 Aug 2013 16:40:19 GMT

I have a series of fields I've extracted using the GUI for a particular sourcetype. I've also set up a lookup table, definition, and automatic lookup using one of those fields. The automatic lookup is supposed to add a field from the lookup table. However, I cannot get it to work with fields that have been extracted using the GUI. Is there something I'm missing? Automatic lookups work just fine on sourcetypes with fields that have been automatically extracted (ie, they arrive at Splunk as "key=value" pairs and require no additional extraction).

Any hints?

Re: Using extracted fields in automatic lookups

lukejadamec — Mon, 12 Aug 2013 16:53:11 GMT

Have you tested the lookup by applying it manually after a search that extracts the fields?

Re: Using extracted fields in automatic lookups

lukejadamec — Mon, 12 Aug 2013 16:54:11 GMT

search | extract | lookup

Re: Using extracted fields in automatic lookups

davecroto — Mon, 28 Sep 2020 14:33:18 GMT

First add an entry in $SPLUNK_HOME/etc/systems/local/transforms.conf:

[alookupexample]
filename=mycsvfile.csv

Then either restart splund or do a | extract reload=t then run a search like the one below:

somesearch | lookup alookupexample <oneofthefieldsyouextractedviagui> OUTPUT <oneofthefieldsinthelookup)in_the_lookup>

oneofthefieldsyouextractedviagui above needs to be the first column of the csv lookup

make sure you are looking at all the interesting fields on the right (blue) of the screen

After you've confirmed that that works put in the correct stanza inside of the props.conf file.

Re: Using extracted fields in automatic lookups

joshua_hart1 — Tue, 13 Aug 2013 17:35:56 GMT

So, I ran the search manually with the lookup and I was able to match fields in the search with fields in the lookup, but the OUTPUT field was not...output. No dice. But, thanks.