Splunk Search

Can do search time lookup but automatic lookup not working


Sorry I use underscores "_" in my variable names and this forum causes those to be italics instead! So I changed all of them to be hyphens "-"

I can do an inline lookup like this:

lookup sonicwall-app-id app-id as app OUTPUT app-name

but when I set it up as an automatic lookup like this:

lookup table: sonicwall-app-id

lookup input fields: app-id, app

lookup output fields: app-name, app-name

Tags (1)
0 Karma


i had a similar issue. make sure that the sourcetype on the data returned matches the sourcetype in your automatic lookup definition

0 Karma


I was able to get this working. The search time lookup is configured a bit differently then the automatic lookup.

  • After adding the lookup table you need to change the permissions so it's at least shared with the app.
  • In my app I have a custom sourcetype for my data so I had to select that or it would not work.
  • The last snag I hit was the variable names. The first value is the variable name from the .csv file. The second is the variable from splunk data. If you get the backwards it won't work. Actually you'll get an error that it couldn't find the field. I recommend leaving the rest blank and it will auto export the rest of the variables from the .csv file.
0 Karma


I'm having the same problem, I'm curious if you ever got this resolved and could post the fix.

0 Karma


what am I doing wrong in the automatic lookup thats preventing the automatic lookup from running?

0 Karma


What is your question?

BTW, you can use underscores by escaping them with '\' or by entering the variables as code.

If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...