Knowledge Management

How to check if the automatic lookup is working?

rajneeshc1981
Explorer

How to check if the automatic lookup is working?
Lookup is working fine how can I test auto lookup is working too?

0 Karma

harish_l
New Member

A lookup definition that you have defined previously.
Steps

In Splunk Web, select Settings > Lookups.
Under Actions for Automatic Lookups, click Add new.
Select the Destination app.
Give your automatic lookup a unique Name.
Select the Lookup table that you want to use in your fields lookup.
This is the name of the lookup definition that you defined on the Lookup Definition page.
In the Apply to menu, select a host, source, or source type value to apply the lookup and give it a name in the named field.
Under Lookup input fields provide one or more pairs of input fields.
The first field is the field in the lookup table that you want to match. The second field is a field from your events that matches the lookup table field. For example, you can have an ip_address field in your events that matches an ip field in the lookup table. So you would enter ip = ip_address in the automatic lookup definition.
Under Lookup output fields provide one or more pairs of output fields.
The first field is the corresponding field that you want to output to events. The second field is the name that the output field should have in your events. For example, the lookup table may have a field named country that you may want to output to your events as ip_city. So you would enter country=ip_city in the automatic lookup definition.
You can select the checkbox for Overwrite field values to overwrite the field values when the lookup runs.
Note: This is equivalent to configuring your fields lookup in props.conf.
Click Save.
The Automatic lookup view appears, and the lookup that you have defined is listed.

0 Karma

pradeepkumarg
Influencer

Run the search where the autolookup is intended to be used. The fields from the lookup should be added to results without explicitly calling lookup. Let's say your auto lookup works on the host field to populate IP address for all sourcetypes then running index=* should give IP address in the fields.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...