How to use an index for a lookup

[subhuman]

Noob question.

I had about a dozen CSVs that had the same information on them but the columns were out of order. I imported them all into a new index and splunk sorted it out no problem. The information on the tables is for the most part static and I would like to use the lookup command and automatic lookups to enrich other indexes with the information in the new index. Is this possible or do I need to export the index as a csv and re-upload it as a lookup table?

[tiagofbmm]

Well one of the option is definitely outputlookup your current "index made of lookups" and the use the lookup command to enrich other data with it.

If you really want to stick with the index format, I'd suggest you to take a look at the join command:

https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Join

[tiagofbmm]

Please let me know if the answer was useful for you. If it was, accept it and upvote. If not, give us more input so we can help you with that

[paulbannister]

Hi There,

You could quite possibly be looking for the inputlookup and outputlookup commands, if you were to write a search using the index that has your csv data in then you could use the above commands to essentially create a new lookup file to be used elsewhere as an automatic lookup

https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Outputlookup