Splunk Search

Help with Lookup table

pgissiner
Engager

I am attempting to display categories from websense logs in human readable form. Currently they display the category id in the Search app rather than the name. I added a lookup table with two columns, one with the category, and one with the category name, comma delimited to achieve this.

Here is my addition to props.conf:

[websense_categories]
LOOKUP-websense = websense category OUTPUT category_name
FIELDALIAS-category = category_name

And to transforms.conf:

[websense]
DELIMS = ","
FIELDS = "category", "category_name"
filename = websense.csv
max_matches = 100

Still when searching websense logs via search app categories appear as numbers rather than the category name. If more information is needed, I can clarify. Thank you,

Tags (1)
0 Karma
1 Solution

kristian_kolb
Ultra Champion

I believe that you are mixing two concepts; REPORT and LOOKUP.

DELIMS and FIELDS in transforms.conf would typically be used in a REPORT (from props.conf)

The FIELDALIAS also misses stuff. It should be;

FIELDALIAS-somename original_field_name AS alternate_field_name 

See the docs for props.conf

As for the LOOKUP itself, you should see the example regarding HTTP status lookups in the docs.

Hope this helps,

Kristian

View solution in original post

kristian_kolb
Ultra Champion

I believe that you are mixing two concepts; REPORT and LOOKUP.

DELIMS and FIELDS in transforms.conf would typically be used in a REPORT (from props.conf)

The FIELDALIAS also misses stuff. It should be;

FIELDALIAS-somename original_field_name AS alternate_field_name 

See the docs for props.conf

As for the LOOKUP itself, you should see the example regarding HTTP status lookups in the docs.

Hope this helps,

Kristian

Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...