topic Re: Can you have cascading automatic lookups? in Splunk Search

Can you have cascading automatic lookups?

danielpellarini — Mon, 08 Feb 2016 17:32:01 GMT

In some of my sourcetypes, I am using automatic CSV lookups to add some data to Splunk (as explained in the docs here).

However, can I have a second automatic lookup over data that was already added with an automatic lookup? I am using the same method as above but it looks like it's not working.

Just to clarify, as an example, suppose I have the UserID field, I then have an automatic lookup that adds the user's birth town to Splunk, can I now have an automatic lookup that adds the country of birth starting from the birth town?

Re: Can you have cascading automatic lookups?

jeffland — Tue, 09 Feb 2016 08:52:39 GMT

Yes, this is possible. You need to name your lookups appropriately, because they are evaluated in alphabetical order. See here for an older question about this.

Re: Can you have cascading automatic lookups?

danielpellarini — Tue, 09 Feb 2016 09:03:17 GMT

Thanks for the link, I somehow managed to miss that. I'll take a look then.

Re: Can you have cascading automatic lookups?

rajneeshc1981 — Mon, 06 Aug 2018 13:52:34 GMT

wha t is automatic lookup ,how do I heck my lookup is setup correctly for automatic lookup .