How to create a lookup table

[ngox0061]

I'm new to Splunk and was wondering how to do a lookup table.  So what i'm trying to get is something like a lookup of: 

index=_internal* log_level=WARN OR log_level=ERR host=XPxx9* OR host=GPxx7* OR host=fsr*

but instead of listing like 30 of the host names with OR arguments, what's the ideal way to do it? can someone provide examples?

[richgalloway]

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

[richgalloway]

When I suspect a lookup file is populated by a saved search, I use this CLI command to find it.

find /opt/splunk/etc/apps -name savedsearches.conf -print0 | xargs -r0 grep -i "outputlookup mylookup.csv"

Yes, I do give karma to good answers.

[inventsekar]

Hi @richgalloway .. that find command solution is very intelligent(far better than searching splunk settings and the 100 options 😉 )

>> Yes, I do give karma to good answers. 

oops, my signature line is meant for all others/the recent day new members. Definitely not for you. in these 5 years i have seen your solutions and i can never say such karma points comments to You. thanks. 

(i have given around 300 karma points so far, received badge for that,.. maybe you also should give karma points if a/any post helped you, thx)

[richgalloway · Accepted solution]

There are a few ways to create a lookup table, depending on your access.

• Use the CLI to create a CSV file in an app's lookups directory
• Use the Lookup File Editor app to create a new lookup
• Go to Settings->Lookups and click "Add new" next to "Lookup table files".  Then fill in the form and upload a file.
• Create a search and save the results using the | outputlookup command.

[inventsekar]

Hi @richgalloway ...

outputlookup // i got a simple issue, but, somehow i could not find the solution from my top of my mind.

lets say i already have a lookup created and working fine(by my old teammate). aftersometime i would like to know how the csv file gets created. when i went to settings-->lookup, i dont see which search query creates the csv file. i think a saved search only uses that outputlookup command and creates that csv file. 

this far only my mind works and i am not sure how to proceed further. pls suggest. thanks. 

(i have given around 300 karma points so far, received badge for that,.. maybe you also give karma points if a/any post helped you, thx)

[ngox0061]

I will try and follow your directions and give it a shot.  Thanks, richgalloway!