Splunk Enterprise

Can I load multiple lookup files from one index?

silverKi
Path Finder

I'm practicing auto-lookup. Auto-lookup of vendors_ip.csv has already been successful in my index.
Here, I would like to add auto-lookup for the prices.csv file in the same index.
The process I followed uploaded a lookup table, created a lookup definition, and created an automatic lookup, but as a result of searching for index=main, only the prices.csv fields are not visible.
The fields of vendors_ip that were previously successful are output.
What I'm curious about is whether it is possible to perform multiple automatic lookups on one index in splunk.
I would also like to know why the automatic lookup is not working.

silverKi_0-1719984943252.png

0 Karma
Get Updates on the Splunk Community!

Monitoring Postgres with OpenTelemetry

Behind every business-critical application, you’ll find databases. These behind-the-scenes stores power ...

Mastering Synthetic Browser Testing: Pro Tips to Keep Your Web App Running Smoothly

To start, if you're new to synthetic monitoring, I recommend exploring this synthetic monitoring overview. In ...

Splunk Edge Processor | Popular Use Cases to Get Started with Edge Processor

Splunk Edge Processor offers more efficient, flexible data transformation – helping you reduce noise, control ...