All Apps and Add-ons

"Lookup File Editor" match_type settings

Mockjin
Explorer

Hi,

i am trying the App "Lookup File Editor" and have problems with the match_type settings. Normal lookups can be configured to use match_type=CIDR or something else. I cant find similar settings in the "Lookup File Editor" app from splunkbase. Do i something wrong or is this feature not included?

 

Thanks

 

Labels (2)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

There are no such settings in the Lookup File Editor app.  The app is for modifying a lookup file.  Match_type settings are for lookups, which may or may not correspond to a lookup file.

IOW, lookups are an abstraction, but the Lookup File Editor is for working with a physical data file.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There are no such settings in the Lookup File Editor app.  The app is for modifying a lookup file.  Match_type settings are for lookups, which may or may not correspond to a lookup file.

IOW, lookups are an abstraction, but the Lookup File Editor is for working with a physical data file.

---
If this reply helps you, Karma would be appreciated.
0 Karma

Mockjin
Explorer

@richgalloway  thank you for your fast answer 🙂 

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...