Splunk Search

Disable automatic lookups for a search

dewoodruff
Path Finder

I am using a summary index where the events being added to it contain different types of data, and therefore have different kinds and numbers of fields. I want to run a generic search against this summary index for when type=alert and have an email generated containing all the fields for that event.

The problem is others using this search head have defined many different automatic lookups that sometimes match my fields. I do not want the alert email to contain any of the automatic lookup output.

How can I disable all automatic lookups for just this search so my email isn't filled with junk? I found this previous question and understand the on up-voted response, but the question is not actually answered - https://answers.splunk.com/answers/113653/ignore-automatic-lookup-just-for-a-search.html

I contemplated doing "|fields -" but there are over 150 auto lookup fields in some cases... Is there a way to disable lookups for a specific eventtype, in which case I can define one for this summary index?

Thanks in advance.

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

The closest that you can probably get is something like this:

Your Search Here | table _time _raw | kv

View solution in original post

0 Karma

woodcock
Esteemed Legend

The closest that you can probably get is something like this:

Your Search Here | table _time _raw | kv
0 Karma

dewoodruff
Path Finder

Perfect, that's exactly what I'm looking for! kv was not in my regular arsenal of commands. Simple and dynamic, thank you.

0 Karma

woodcock
Esteemed Legend

The automatic lookups should be contained within a stanza with a sourcetype in the definition, but clearly yours are not. The problem is not that it is exported globally to all apps, it is that it is defined by some kind of wildcard, which is not the right way to do it. Find the automatic lookup definition and ensure that it is associated with only the specific sourcetype values to which it applies.

0 Karma

dewoodruff
Path Finder

Thanks. Almost all of the lookups come from TAs like the TA for Windows or Identity Management. They're doing things like pulling out any 'user' field regardless of source type and enriching with LDAP information.

Other examples are the built in date_ fields. I don't think those are lookups, are they? Maybe I'm asking with the wrong term.

What I'm really looking for is a search command that will output only the fields that were extracted from the log message itself - no enrichments, no lookups, no built-ins. Does such a thing exist?

0 Karma

woodcock
Esteemed Legend

See my new answer.

0 Karma

to4kawa
Ultra Champion

How about changing the permission of lookup to limit the users who can use it?

0 Karma

dewoodruff
Path Finder

That's an idea. I don't think our admins would go for that though. Many of the lookups come from TAs.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...