Lookups with a python script

[Marinus]

The transforms spec indicated that you can do a lookup using a python script. Do you have an example?

[bansi]

I think if someone has already developed similar article to connect to DB2 database and lookup table at search time then please publish it otherwise i am working on it and will be glad to publish it if i get little help from Splunk Forums on how to integrate my working copy under Python 2.7 with Splunk Python 2.6

[Lowell]

For anyone interested in a database lookup script example, I have posted one here:

• I want sample code to connect to Oracle database, and lookup a table at search time

[gkanapathy · Accepted solution]

There is an example in $SPLUNK_HOME/etc/system/bin/external_lookup.py.

[gkanapathy]

Not really, but it's the same. All you do is add another column to the output CSV and add the extra field in the appropriate places in the configuration. Basically, Splunk passes a CSV file in to the script, with lookup values in the input columns/fields and null values in the output columns/fields, and your script should write out a CSV with all the fields filled in.

[Marinus]

Thanks Gerald, do you have an example if you want to return more than one field based on your lookup?