Splunk Search

Lookups with backslash in key

JensT
Communicator

Hi,

We're analazing database logs. From SyBase, Oracle and MSSQL.

MSSQL full db instances contain a \

e.g. MSNG123\MyInstance

We want to use a lookup to enrich the data.

It works fine with the lookup command. But not using the automatic lookup.

Any suggestions?

Using Splunk 4.3.6

Regards,

Jens

Tags (2)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi JensT,

to make it short, this works as well with the automatic lookup. I did a quick test on VERSION=4.3.6 BUILD=153775 PRODUCT=splunk PLATFORM=Linux-x86_64 with a lookup file containing the following data:

host,database
myhost,"foo\myDB"
#myhost,bar\\yourDB
#myhost,'bar\yourDB'
#myhost,baryourDB

I did setup an automatic lookup for sourcetype, source and host and all three of them were working. I was able to get back database values like foo\myDB or 'bar\yourDB'

I think the problem is, that either the sourcetype, source or host name do not match. For example automatic lookup in my test for sourcetype=* did not work, but with sourcetype=splunkd_access it worked.

I did use a run everywhere search like this: index=_internal | head 1 | table host database which will return one event of sourcetype=splunkd_access and this was my test automatic lookup in props.conf:

[splunkd_access]
LOOKUP-mydb = mydatabase host AS host OUTPUTNEW database AS database

and the result will be this:

alt text

hope this helps ...

cheers, MuS

PS: Grüsse aus Basel 😉

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi JensT,

to make it short, this works as well with the automatic lookup. I did a quick test on VERSION=4.3.6 BUILD=153775 PRODUCT=splunk PLATFORM=Linux-x86_64 with a lookup file containing the following data:

host,database
myhost,"foo\myDB"
#myhost,bar\\yourDB
#myhost,'bar\yourDB'
#myhost,baryourDB

I did setup an automatic lookup for sourcetype, source and host and all three of them were working. I was able to get back database values like foo\myDB or 'bar\yourDB'

I think the problem is, that either the sourcetype, source or host name do not match. For example automatic lookup in my test for sourcetype=* did not work, but with sourcetype=splunkd_access it worked.

I did use a run everywhere search like this: index=_internal | head 1 | table host database which will return one event of sourcetype=splunkd_access and this was my test automatic lookup in props.conf:

[splunkd_access]
LOOKUP-mydb = mydatabase host AS host OUTPUTNEW database AS database

and the result will be this:

alt text

hope this helps ...

cheers, MuS

PS: Grüsse aus Basel 😉

JensT
Communicator

Hi!

i retested and you are absolutely right!

1.) \ in any lookup is not a problem.

2.) Its MSSQL not MSSSQL


Thanks,

Jens

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...