Can you have cascading automatic lookups?

[danielpellarini]

In some of my sourcetypes, I am using automatic CSV lookups to add some data to Splunk (as explained in the docs here).

However, can I have a second automatic lookup over data that was already added with an automatic lookup? I am using the same method as above but it looks like it's not working.

Just to clarify, as an example, suppose I have the UserID field, I then have an automatic lookup that adds the user's birth town to Splunk, can I now have an automatic lookup that adds the country of birth starting from the birth town?

[jeffland · Accepted solution]

Yes, this is possible. You need to name your lookups appropriately, because they are evaluated in alphabetical order. See here for an older question about this.

[danielpellarini]

Thanks for the link, I somehow managed to miss that. I'll take a look then.

[rajneeshc1981]

wha t is automatic lookup ,how do I heck my lookup is setup correctly for automatic lookup .