Splunk Search

Record value from a lookuptable at indextime

New Member

I would like to record a user's department at the time of the event rather than search time. I have username => department in a lookup table.

Conceptually, at index time, I would like a new field (eg "department") to be populated with the result of

[ lookup user username OUTPUT department ]

(How )can I do this?

0 Karma
1 Solution

Esteemed Legend

You can't so don't even try. Instead, use a time-based lookup:
http://docs.splunk.com/Documentation/Splunk/6.6.1/Knowledge/Configureatime-boundedlookup

Then you do the lookup with _time for every event and aggregate afterwards. Obviously, you cannot use tstats but other than that, this should be fine.

If you absolutely have to do this, you would create a Summary Index this as a separate data source and do your own search-based merging.

View solution in original post

Esteemed Legend

You can't so don't even try. Instead, use a time-based lookup:
http://docs.splunk.com/Documentation/Splunk/6.6.1/Knowledge/Configureatime-boundedlookup

Then you do the lookup with _time for every event and aggregate afterwards. Obviously, you cannot use tstats but other than that, this should be fine.

If you absolutely have to do this, you would create a Summary Index this as a separate data source and do your own search-based merging.

View solution in original post

New Member

Thanks, I'll give that a try 🙂

0 Karma

SplunkTrust
SplunkTrust

Use of lookup table at index time is not possible. The closest you can get to correctly identify the department of the user based on the time of indexing (as user may switch departments), will be to setup time-based lookup. See this for more information.
http://docs.splunk.com/Documentation/Splunk/6.6.1/Knowledge/Configureatime-boundedlookup

0 Karma