Lookup by file name

[hartfoml]

Hi group...

I have systems that are categorized into security groups.

I have one spreadsheet for each group with system names and associated IP if possible in that group.

I want to be able to add this information to any search for the system.

If I find the system in IDS or Proxy search I want to know what security group the system is in and who owns the group.

Should I do this with lookup table or is there a better way?
Should I create a lookup table with all the info or one lookup table for each group with the systems in that group in each file???
Should i add this info to the log on index time so it becomes part of the record like with a props.conf and transforms.conf entry?? This seem like too much work.

[kristian_kolb]

As Ayn says, consider using tags, or if you take the lookup table approach, use one table. That way you can just add the security group info like in;

http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/Addfieldsfromexternaldatasources#Example...

/K

[Ayn]

Have you considered using tags?