Splunk Search

How can I use lookup csv from another Index?

arusoft
Explorer

How can I use lookup csv from another Index? I have access to both index.

Thanks.

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @arusoft,

sorry, no other way!

If this answer solves your need, please accept it for the other people of Community.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @arusoft,

what do you mean with lookup from another index?

lookups aren't related to index!

if you're speaking of a lookup of another app, you have only to define the app and the app definition as global.

could you better describe your question?

Ciao.

Giuseppe

arusoft
Explorer

Sorry, by index I meant App.

So when I logged into an App and I run this command  | inputlookup my_lookup.csv I get the results.

But when I run the same command for same lookup in another app (for which I have power user access), I don't get results.  So wondering is there something I can do in query to get results from lookup of another app.

 

Thank You.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @arusoft,

you have to give to your Lookup and Lookup Definition (remember of it otherwise it doesn't run!) a Global sharing and you'll see it in all your apps.

Ciao.

Giuseppe

0 Karma

aasabatini
Communicator

Hi @arusoft 

 

@gcusello  replied to you  to define the app and the app definition as global.

go to settings and lookup 

select global on sharing

aasabatini_0-1617980933634.png

 

0 Karma

arusoft
Explorer

So there is no way to access lookup of another app even though I have access to that App?

I was hoping since I have access I should somehow qualify a lookup with app name and able to view them.  The reason I am saying this is because I don't have access to make changes to that lookup. I have permission only to view that lookup.

 

Regards.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @arusoft,

You can view the content of a lookup:

  • in every app, if it's shared a Global level,
  • in its own app, if it's shared at App level.

No other ways.

If you can access the lookup in the app, you could export the content in your pc and upload it in your own version of the lookup, but ot's only manual.

Ciao.

Giuseppe

0 Karma

arusoft
Explorer

Thank you again. So looks like not possible without having its access changed to Global level. This is what I was trying to find. My goal was to view it without making any changes. 

Regards.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @arusoft,

sorry, no other way!

If this answer solves your need, please accept it for the other people of Community.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

View solution in original post

0 Karma