Splunk Search

Lookup Tables and Comments

jchensor
Communicator

I currently am using a lookup table to match Host Names with a "grouping" category. However, there are a ton of entries in there and the order I have them in the file isn't directly obvious, so to make it easier for me to search through and edit the file, I'd love it if I could add "comments" to the lookup file. Is this possible? Can we start lines with a ':' or a '#' character or something and cause that line to be ignored during the lookup process?

Tags (3)
1 Solution

Drainy
Champion

Well its a CSV so you can't comment it.
But, you could add a comment field and simply not reference it during the lookup process? That way it will idle there un-used

UPDATE:

One way could be,

host,ip,comment
BOB,127.0.0.1,danger danger!

But you could avoid referencing the comment field completely

View solution in original post

Drainy
Champion

Well its a CSV so you can't comment it.
But, you could add a comment field and simply not reference it during the lookup process? That way it will idle there un-used

UPDATE:

One way could be,

host,ip,comment
BOB,127.0.0.1,danger danger!

But you could avoid referencing the comment field completely

Drainy
Champion

have a look at my updated answer for an example of another way to do it

0 Karma

jchensor
Communicator

Yeah, I was just thinking that a "generic" Host Name like "#comment#" that would never actually be the name of a machine could just be treated as a comment. I was hoping that maybe Splunk's lookup process would have its own construct built-in that ignored certain lines. But you're probably right in that it most likely wouldn't. ^_^

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...