Splunk Search

Automatic Lookup not applying to scripted inputs

jamesvz84
Communicator

I have implemented an automatic lookup by specifying the filename in transforms.conf:

[host_info]
filename = host_info.csv

and also defining the lookup in props.conf:

[source::*]
LOOKUP-host_info_for_windows = host_info host OUTPUTNEW ip,site,subnet

This is working for most sources, however I notice it is not working for my scripted input sources. It simply does not display the ip and site fields for those sources. Do I have to configure anything special for the automatic lookup to apply to the scripted input sources?

0 Karma

jamesvz84
Communicator

I ended up just explicitly calling a lookup for the scripted input sources. Not the most ideal solution, but it works.

search xxx | lookup host_info.csv host OUTPUTNEW ip | 
0 Karma
Get Updates on the Splunk Community!

Application management with Targeted Application Install for Victoria Experience

  Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...

Index This | What goes up and never comes down?

January 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Splunkers, Pack Your Bags: Why Cisco Live EMEA is Your Next Big Destination

The Power of Two: Splunk + Cisco at "Ludicrous Scale"   You know Splunk. You know Cisco. But have you seen ...