topic Re: automatic lookups in Splunk Search

automatic lookups

a212830 — Wed, 02 May 2012 20:43:05 GMT

Hi,

I configured a lookup that works fine, if I explicitly use the lookup statement in my search, but I want the field to auto-populate, based upon the sourcetype. Is there a way to do this?

Re: automatic lookups

Ayn — Wed, 02 May 2012 21:01:02 GMT

Yes, you set this in props.conf using the LOOKUP directive. For instance

[mysourcetype]
LOOKUP-foo = mylookuptable somefield OUTPUT somelookedupfield

http://docs.splunk.com/Documentation/Splunk/4.3/admin/Propsconf

Re: automatic lookups

a212830 — Wed, 02 May 2012 21:33:55 GMT

Did that - doesn't work.

LOOKUP-hostdb = hostdb_lookup srcIP OUTPUTNEW deviceName

Re: automatic lookups

kristian_kolb — Wed, 02 May 2012 21:53:20 GMT

As Ayn states, this can be done with a LOOKUP-statement in props.conf, but you also need the corresponding transforms.conf stanza to make it work. I recently posted an answer to this type of question;

http://splunk-base.splunk.com/answers/5916/using-cidr-in-a-lookup-table?page=1&focusedAnswerId=46866#46866

Have a look, and if you don't figure it out, feel free to provide more information regarding what you're trying to do.

Hope this helps,

Kristian

Re: automatic lookups

AllenZhang — Wed, 27 Jan 2016 14:39:44 GMT

needs restart to make it work?