Archive

Lookups with a python script

Communicator

The transforms spec indicated that you can do a lookup using a python script. Do you have an example?

Tags (1)
1 Solution

Splunk Employee
Splunk Employee

There is an example in $SPLUNK_HOME/etc/system/bin/external_lookup.py.

View solution in original post

Path Finder

I think if someone has already developed similar article to connect to DB2 database and lookup table at search time then please publish it otherwise i am working on it and will be glad to publish it if i get little help from Splunk Forums on how to integrate my working copy under Python 2.7 with Splunk Python 2.6

0 Karma

Super Champion

For anyone interested in a database lookup script example, I have posted one here:

Splunk Employee
Splunk Employee

There is an example in $SPLUNK_HOME/etc/system/bin/external_lookup.py.

View solution in original post

Splunk Employee
Splunk Employee

Not really, but it's the same. All you do is add another column to the output CSV and add the extra field in the appropriate places in the configuration. Basically, Splunk passes a CSV file in to the script, with lookup values in the input columns/fields and null values in the output columns/fields, and your script should write out a CSV with all the fields filled in.

0 Karma

Communicator

Thanks Gerald, do you have an example if you want to return more than one field based on your lookup?

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!