Splunk Search

How to access a lookup table belonging to another app?

brdr
Contributor

I've read the documentation that if permissions are set to Global for a lookup that it can be accessed from within another app.

I want to be able to access the following lookup from the location below while I'm in Search and Reporting app.

/apps/splunk/etc/apps/SA-ThreatIntelligence/lookups/asn_by_cidr.csv

In Search I tried:

| inputlookup /apps/splunk/etc/apps/SA-ThreatIntelligence/lookups/asn_by_cidr.csv 

But I get nothing back.

Tags (1)
1 Solution

jkat54
SplunkTrust
SplunkTrust

Try this:

| inputlookup asn_by_cidr.csv

View solution in original post

0 Karma

jkat54
SplunkTrust
SplunkTrust

Try this:

| inputlookup asn_by_cidr.csv

0 Karma

brdr
Contributor

I also tried that syntax as well to no avail.

0 Karma

brdr
Contributor

Hi jkat54, I don't access to log into the search head to view the lookup on file. I actually now think the lookup file is empty, and hence producing no events. I can successfully access another lookup within SA-ThreatIntelligence.... We can close this one. thank you.

jkat54
SplunkTrust
SplunkTrust

I found it to be empty in my testing too

0 Karma

jkat54
SplunkTrust
SplunkTrust

If you open the enterprise security app and go to search drop down select search in drop down, try the same search and let me know.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...