Record value from a lookuptable at indextime

[fooflington]

I would like to record a user's department at the time of the event rather than search time. I have username => department in a lookup table.

Conceptually, at index time, I would like a new field (eg "department") to be populated with the result of

[ lookup user username OUTPUT department ]

(How )can I do this?

[woodcock · Accepted solution]

You can't so don't even try. Instead, use a time-based lookup:
http://docs.splunk.com/Documentation/Splunk/6.6.1/Knowledge/Configureatime-boundedlookup

Then you do the lookup with _time for every event and aggregate afterwards. Obviously, you cannot use tstats but other than that, this should be fine.

If you absolutely have to do this, you would create a Summary Index this as a separate data source and do your own search-based merging.

[fooflington]

Thanks, I'll give that a try 🙂

[somesoni2]

Use of lookup table at index time is not possible. The closest you can get to correctly identify the department of the user based on the time of indexing (as user may switch departments), will be to setup time-based lookup. See this for more information.
http://docs.splunk.com/Documentation/Splunk/6.6.1/Knowledge/Configureatime-boundedlookup