Splunk Enterprise

lookup

VijaySrrie
Builder

Hi,

In lookup definition,

IT_server_list is created in lookup definition which is mapped to CSV named (server_list.csv)

In Lookup Table,

server_list.csv file is there

In automatic lookup,

IT_server_list is created

why do we need automatic lookup?

 

0 Karma
1 Solution

venkatasri
SplunkTrust
SplunkTrust

Hi @VijaySrrie 

Your transforms.conf should be having lookup definition, that is enough for you to run | lookup command in UI.

What if the search events to be enriched automatically by adding additional field when someone search the sourcetype/host/source. Then props.conf automatic lookup LOOKUP-<class>=  syntax works.

Docs says: you can optionally create an additional props.conf configuration that makes the lookup "automatic." This means that it runs in the background at search time and automatically adds output fields to events that have the correct match fields.

Splunk user doesn't need to use | lookup command everytime, if automatic lookup been configured one time. Refer - Make your lookup automatic - Splunk Documentation

---

An upvote would be appreciated and Accept solution if this reply helps!

View solution in original post

venkatasri
SplunkTrust
SplunkTrust

Hi @VijaySrrie 

Your transforms.conf should be having lookup definition, that is enough for you to run | lookup command in UI.

What if the search events to be enriched automatically by adding additional field when someone search the sourcetype/host/source. Then props.conf automatic lookup LOOKUP-<class>=  syntax works.

Docs says: you can optionally create an additional props.conf configuration that makes the lookup "automatic." This means that it runs in the background at search time and automatically adds output fields to events that have the correct match fields.

Splunk user doesn't need to use | lookup command everytime, if automatic lookup been configured one time. Refer - Make your lookup automatic - Splunk Documentation

---

An upvote would be appreciated and Accept solution if this reply helps!

Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...