All Apps and Add-ons

"Lookup File Editor" match_type settings

Mockjin
Explorer

Hi,

i am trying the App "Lookup File Editor" and have problems with the match_type settings. Normal lookups can be configured to use match_type=CIDR or something else. I cant find similar settings in the "Lookup File Editor" app from splunkbase. Do i something wrong or is this feature not included?

 

Thanks

 

Labels (2)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

There are no such settings in the Lookup File Editor app.  The app is for modifying a lookup file.  Match_type settings are for lookups, which may or may not correspond to a lookup file.

IOW, lookups are an abstraction, but the Lookup File Editor is for working with a physical data file.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There are no such settings in the Lookup File Editor app.  The app is for modifying a lookup file.  Match_type settings are for lookups, which may or may not correspond to a lookup file.

IOW, lookups are an abstraction, but the Lookup File Editor is for working with a physical data file.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

Mockjin
Explorer

@richgalloway  thank you for your fast answer 🙂 

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!