External source for external lookup

[jvmerilla]

Hi,
I'm trying to create an external lookup but I'm getting very confused.
What are the external sources that I can use where I can match the fields of my events?
I'm very new on this topic so I don't really have any idea.
I've read the documentation but everything is still vague.

Hope someone can clarify these things to me.

Thanks in advance.

[elliotproebstel · Accepted solution]

An external lookup is a script that you write to allow users to take a value in Splunk and lookup a corresponding value in some other source. Because external lookups are custom scripts that you write, the list of potential external sources is infinite. The canonical example, which is provided by Splunk, is a dnslookup that allows the user to resolve a hostname from an IP address or vice versa. This is pretty well documented here:
http://docs.splunk.com/Documentation/Splunk/7.0.0/Knowledge/Configureexternallookups

You can take the sample code provided by Splunk and modify it to use any data source to which you have access.