Knowledge Management

What is the difference between a standard lookup and an Enterprise Security managed lookup?

pdenorch
Engager

I'm not having any luck finding what the functional differences are between a lookup created in splunk core ( Settings > Lookups > add new) that lives in the ES app context, and a managed lookup created from the content management page ( ES > configure > Content Management > Create New Content ). 

I have created and experimented with both and I can't find any functional difference. The documentation describes how to create managed lookups but I'm not finding anything on what the point is. 

Labels (1)
0 Karma
1 Solution

starcher
SplunkTrust
SplunkTrust

All managed means is you can edit the lookup with the  UI editor in ES. As long as it’s not too large. 

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @pdenorch,

they are both lookups that you can edit using the Lookup Editor App and/or use in your searches, inside and outside ES.

The only difference is that the ES Managed Lookups are part of ES, so the lookup itself and the generating searches are inside ES and you can enable or disable inside ES instead using the Settings menu.

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @pdenorch,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

Tags (1)
0 Karma

starcher
SplunkTrust
SplunkTrust

All managed means is you can edit the lookup with the  UI editor in ES. As long as it’s not too large. 

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...