Splunk Dev

Scripted Lookup Output and Configuring in Splunk

aaronnicoli
Path Finder

Hi all,

Everyone in my organization has a unique username, which I have extracted from my search as "anumber".
I want to construct an external lookup script to convert this "anumber" extraction into human names.

All of these anumbers are convertible via an AD lookup, which I have scripted.

This is basically what I want to achieve, in my fields I want to be able to see both anumber and humanname, for example:

anumber = "a00001"
humanname = "Michael Someone"

I have written a python script which works as follows...

./a0convert.py a00001

Returns:

Someone, Michael

Now, two questions...

1) Is this script output okay, or does it need to be formatted differently...?

2) How do I now add this scripted lookup into splunk? (preferably with the GUI, what needs to be done under "Lookups")

Thanks in advance for any help you can provide.

Aaron.

0 Karma

MarioM
Motivator

Here it tells you how to Set up fields lookup based on an external command or script and there is example script.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...