Splunk Search

Can anyone explain what does these lookup statements mean ?

zacksoft_wf
Contributor

| lookup update=true SpamIntel_by_email_subject subject OUTPUT
| lookup update=true SpamIntel_by_email_subject_wildcard subject OUTPUTNEW

What is update=true ?
What field it is comparing to update what ?
Whats the difference between between Output and Outputnew

I didn't understand from the splunk's documentation well.

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @zacksoft_wf,

as you can see at https://docs.splunk.com/Documentation/Splunk/8.2.5/SearchReference/Lookup

About the first question: update=True

If the lookup table is modified on disk while the search is running, real-time searches do not automatically reflect the update.

To do this, specify update=true.

This does not apply to searches that are not real-time searches.

This implies that local=true.

Default: false

About the second question: difference between OUTPUT and OUTPUTNEW

When using the lookup command, if an OUTPUT or OUTPUTNEW clause is not specified, all of the fields in the lookup table that are not the match fields are used as output fields.

If the OUTPUT clause is specified, the output lookup fields overwrite existing fields.

If the OUTPUTNEW clause is specified, the lookup is not performed for events in which the output fields already exist.

In few words:

  • update=True is only for real-time searches,
  • OUTPUT overrides existing fields, OUTPUTNEW no.

Ciao.

Giuseppe

0 Karma

zacksoft_wf
Contributor

Is the 'subject' field of the lookup 'SpamIntel_by_email_subject' getting updated , as a result of this command ?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @zacksoft_wf,

no, it's the opposite:

using OUTPUT option, if you already have from the main search a value in one of the fields in OUTPUT, it's ovewritten by the value of the lookup.

To override a value in a lookup, you have to use outputlookup but it's a different thing.

Ciao.

Giuseppe

0 Karma

zacksoft_wf
Contributor

@gcusello 
In my lookup command after OUTPUT there is no field, and thats what makes me wonder what field will overwrite/write what...after comparing with what
Let me put the code

| tstats `summariesonly` values(sourcetype) as sourcetype,
values(Email.src) as src,
values(Email.dest) as dest
from datamodel=Email.Email
by Email.subject
| `drop_dm_object_name("Email")`
| lookup update=true SpamIntel_by_email_subject subject OUTPUT

What's the SPL doing where ?
Sorry  for the stupid question but this  particular lookup command usage confuses me .


0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @zacksoft_wf,

after OUTPUT you have to list the lookup fields you want, e.g.:

| lookup update=true SpamIntel_by_email_subject subject OUTPUT field1 field2 field3

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...