It seems that the lookup table for defining extra fields in datamodel can not be a dblookup (database lookup)? Can someone confirm this is the case and not a bug?
The dblookup works fine in standalone search, but I am not able to make it to work in datamodel editor.
I think that's correct... if you can take a bit of delay in recognizing the new schema, you can use the dblookup to regularly generate a new Splunk lookup.
Could you pls elaborate more what do you mean by "you can use the dblookup to regularly generate a new Splunk lookup"?
a saved search that looks something like this:
dblookup mydb "select * from mytable" | outputlookup mylookup
then you use mylookup in your searches
Did you mean |dbquery instead of |dblookup.
I was using |dbquery but the lookup file kept growing and its huge. To avoid this we also wanted to implement dblookup in datamodel.
d'oh -- yes, that is what i meant... can you use a SQL limit to keep the size of your query down?
maybe it would work better to dbquery blah | dedup eventid | collect mysummary?
We thought about that but not preferable to create new summary index in this case.