Lookups with backslash in key

[JensT]

Hi,

We're analazing database logs. From SyBase, Oracle and MSSQL.

MSSQL full db instances contain a \

e.g. MSNG123\MyInstance

We want to use a lookup to enrich the data.

It works fine with the lookup command. But not using the automatic lookup.

Any suggestions?

Using Splunk 4.3.6

Regards,

Jens

[MuS · Accepted solution]

Hi JensT,

to make it short, this works as well with the automatic lookup. I did a quick test on VERSION=4.3.6 BUILD=153775 PRODUCT=splunk PLATFORM=Linux-x86_64 with a lookup file containing the following data:

host,database
myhost,"foo\myDB"
#myhost,bar\\yourDB
#myhost,'bar\yourDB'
#myhost,baryourDB

I did setup an automatic lookup for sourcetype, source and host and all three of them were working. I was able to get back database values like foo\myDB or 'bar\yourDB'

I think the problem is, that either the sourcetype, source or host name do not match. For example automatic lookup in my test for sourcetype=* did not work, but with sourcetype=splunkd_access it worked.

I did use a run everywhere search like this: index=_internal | head 1 | table host database which will return one event of sourcetype=splunkd_access and this was my test automatic lookup in props.conf:

[splunkd_access]
LOOKUP-mydb = mydatabase host AS host OUTPUTNEW database AS database

and the result will be this:

hope this helps ...

cheers, MuS

PS: Grüsse aus Basel 😉

[JensT]

Hi!

i retested and you are absolutely right!

1.) \ in any lookup is not a problem.

2.) Its MSSQL not MSSSQL

Thanks,

Jens