Splunk Search

How to use time-base-lookup?

akanno
Communicator

Hi,Splunk community.

I have a question about time-base-lookup.

I set following attribute to transforms.conf

[test]
collection = test
external_type = kvstore
fields_list = ip,unit,time
time_field = time
time_format = %d/%m/%y/%H

and I set following attribute to collections.conf.

[test]

Result of "| inputlookup test" is following.

ip time unit
192.168.150.81 09/12/14/18 B部
192.168.150.6 09/12/14/18 A部
192.168.150.81 09/12/14/17 D部
192.168.150.6 09/12/14/17 C部

I search by "index=test | lookup test ip".
However lookup does not work.

Why doesn't work?
Is there a way to solve?

Tags (1)
0 Karma

dolivasoh
Contributor

You had it right with "| inputlookup test", just continue your search from there or use the lookup table as enrichment to indexed data. Lookups do no go in the index.

0 Karma

akanno
Communicator

dolivasoh,Thank you for your response.

I have tried outputting the field as "index=test | lookup test ip output unit | table _time,unit,ip".

However , I don't get "unit" field.

0 Karma

dolivasoh
Contributor

Try outputting the field you want from the lookup table, lookup {{table_name}} {{input_field}} output {{output_field}}

0 Karma

akanno
Communicator

Results when I search in "index=test | table _time,ip" are following.

results
_time ip
2014-12-09 18:00:01 192.168.150.81
2014-12-09 18:00:01 192.168.150.81
2014-12-09 18:00:01 192.168.150.6

If lookup correctly works , results when I search "index=test | lookup test ip | table _time,unit,ip" are like following.

results
_time unit ip
2014-12-09 18:00:01 B部 192.168.150.81
2014-12-09 18:00:01 B部 192.168.150.81
2014-12-09 18:00:01 A部 192.168.150.6

However , I don't get the above results.
why can't I get the above result?
Results I get are following

results
_time unit ip
2014-12-09 18:00:01 192.168.150.81
2014-12-09 18:00:01 192.168.150.81
2014-12-09 18:00:01 192.168.150.6

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...