Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Help with props.conf with lookup?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
All,
I have a lookup, which I in turn want to do a couple aliases on. But doesn't seem to work. I get clienthost back, but the aliases don't. Any idea what I might be doing wrong here?
## Some DNS
FIELDALIAS-real_ip_as_clientip = real_ip as clientip
LOOKUP-dns = dnslookup clientip OUTPUT clienthost
FIELDALIAS-clienthost_as_src_host = clienthost AS src_host
FIELDALIAS-clienthost_as_src_dns = clienthost AS src_dns
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Have a look at this really nice Splunk documentation which provides sequence of all search time operation.
https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/Searchtimeoperationssequence
The Field Aliasing happes before Lookup, that's the reason you don't see your clienthost aliases.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Have a look at this really nice Splunk documentation which provides sequence of all search time operation.
https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/Searchtimeoperationssequence
The Field Aliasing happes before Lookup, that's the reason you don't see your clienthost aliases.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Dang, that's no good. Any work around for this?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This might work:
LOOKUP-dns = dnslookup clientip OUTPUT clienthost clienthost as src_host clienthost as src_dns
basically lookup is outputting 3 fields (same field with different names)
Community Content Calendar, September edition
Splunkbase Unveils New App Listing Management Public Preview
Leveraging Automated Threat Analysis Across the Splunk Ecosystem
