Getting Data In

How to get Lookups into an Index?

bofasplunkguy
Explorer

I would like to get my lookups (both CSV and KV Store) into an index, perhaps maybe once a day. This way I can view changes over view and would have an easy backup, not to mention it would be easier to search without needing to join on the inputlookup command.

Can anyone help me with an easy way to index my lookup data?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi bofasplunkguy,
at first put these values in a summary index so you don't pay license!
You can do this with the collect command, e.g.:

| inputlookup my_lookup
| fields field1 field2 field3
| collect index=my_summary

Then you can search on the summary index.

Bye.
Giuseppe

dmarling
Builder

You can use a collect statement to write the data from your lookup/kv store to an index: https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Collect

Example:

| inputlookup mylookup
| collect index=myindex source=mylookupdaily

Then you schedule that to run daily as an alert or report. This won't count towards your license usage unless you set the sourcetype to anything other than the default "stash" on the collect statement.

If this comment/answer was helpful, please up vote it. Thank you.
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...