Splunk Search

How to access a lookup table belonging to another app?

brdr
Contributor

I've read the documentation that if permissions are set to Global for a lookup that it can be accessed from within another app.

I want to be able to access the following lookup from the location below while I'm in Search and Reporting app.

/apps/splunk/etc/apps/SA-ThreatIntelligence/lookups/asn_by_cidr.csv

In Search I tried:

| inputlookup /apps/splunk/etc/apps/SA-ThreatIntelligence/lookups/asn_by_cidr.csv 

But I get nothing back.

Tags (1)
1 Solution

jkat54
SplunkTrust
SplunkTrust

Try this:

| inputlookup asn_by_cidr.csv

View solution in original post

0 Karma

jkat54
SplunkTrust
SplunkTrust

Try this:

| inputlookup asn_by_cidr.csv

0 Karma

brdr
Contributor

I also tried that syntax as well to no avail.

0 Karma

brdr
Contributor

Hi jkat54, I don't access to log into the search head to view the lookup on file. I actually now think the lookup file is empty, and hence producing no events. I can successfully access another lookup within SA-ThreatIntelligence.... We can close this one. thank you.

jkat54
SplunkTrust
SplunkTrust

I found it to be empty in my testing too

0 Karma

jkat54
SplunkTrust
SplunkTrust

If you open the enterprise security app and go to search drop down select search in drop down, try the same search and let me know.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...