I am going over one of the recipes in the online Splunk Book, pages 113 and 114. The example is solving the problem of using an explicit lookup and the eval coalesce command to provide a default field value if the event's value is not in the lookuptable.
The example they provided is:
.....| lookup mylookup ip | eval domain=coalesce(domain, "unknown")
It is said that the mylookup file has two fields of "host" and "machine_type".
| lookupcommand should be the sourcetype that contains the events, for example, sourcetype=bro_http. Is this correct?
1: Almost: it actually is your fully qualified base search which should almost always include
index=and usually also
2: The field
ip is a field in your raw events that has
dotted-quad IPv4 addresses in it.
3: Without having the workbook, it is hard to say, but the bottom line is, it does not matter; it just has to exist or come from somewhere and for the purposes of learning, it makes no difference at all. It does NOT come automatically, though, like