Splunk Search

Add field to an Automatic Lookup


Hi All, 

I am trying to replace gentimes from my query due to slowness. I have read that if I add the field to an automatic lookup that can help me replace the gentimes. The lookup has already been defined and created already, but I still cant seem to add the field to the lookup...  Any thoughts on how I can add the field to the automatic lookup ? Info:

This is the lookup I need to associate the app name to: lkp_rankedReviews

This is the app name I need to associate the lookup to: app=xyz

I have tried in the automatic lookup:

*Lookup input fields:
lkp_rankedReviews = app 

also tried:

Lookup output fields:
lkp_rankedReviews = app 


Labels (1)
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!