How to Access Application specific lookup when multiple have the same name?

[bdunstan]

Hi,

Is there a way to target which application lookup you want to use?

Lets say there are 3 applications, A, B and C,  where A and B each has device.csv but they have different data in them. Depending on a requirement Application C needs to use device.csv from A and other times it needs it from B.  That is, I cant use permissions to restrict the lookup, as application C needs access to both.

Is it possible to prepend the application to the lookup or csv at search time - so that I know define which lookup I want to access?

Something like:
| inputlookup A::device.csv - I tried this and it didnt work 🙂 

regards
-brett

[isoutamo]

Hi

I cannot recall that kind of option for lookups. Splunk select the used lookup file based on current precedence of place where your SPL is running.

One workaround is that you could do it by using field as a lookup name. Of course this needs that all those names are unique. You could named those like app_a_devices and app_b_devices.

Just define those lookups first by GUI / config files, then you can try e.g.

| makeresults
| eval lookup_name="test_2"
| map search="|inputlookup $lookup_name$ "

 r. Ismo

[bdunstan]

Thanks. 

At this stage its not an easy option to update the lookups, as they are coming from different systems which I dont control. I could intercept these files and change them - but would rather not.

I will raise a feature request to see if its possible to treat lookups like scripts where we can add <app>:<script>.js. Or, even if the lookup definitions could point to specific csv files, then I could create different definitions pointing to a specific app/lookup combination.

eg: 
definition a_device -> AppA::device.csv
definition b_device -> AppB::device.csv

This way I could still have control over which lookup was used.