Adding documentation to events

[rotate]

I have been thinking about about having documentation "attached" to events. For example a short explanation of a function call.

Could lookups be the best way to achieve this, or would something else be better? Is this a silly idea, or feasible?

[somesoni2]

This is non-silly-totally-feasible idea and is been used in Splunk from time (at least) I started working in Splunk. IMO lookups are the best way to achieve this, have some sort of ID/key field in the result and lookup that field to get more detailed information. (one such example could be to have customer ID in the logs and then customer ID and customer Details in lookup).

[martin_mueller]

You can find Splunk itself documenting events using lookups in the Common Information Model app at http://apps.splunk.com/app/1621/ - for example there's a lookup documenting HTTP status codes with their English textual representation, that gets added to access logs and can be used for user-friendly charting.