Splunk Search

Temporal Lookups

craigmunro
Path Finder

Hi, I was hoping to use a lookup table to add some fields but it doesn't seem to do quite what I was hoping.

I have the following file, lookup.csv:

timestamp,host,env
2010-02-28 17:26:00,host1,dev
2010-02-28 16:50:00,host2,uat
2010-02-28 16:34:00,host1,uat

and I would like events from host1 to have the field env=uat for events up until 17:26 and env=dev for events after that. Instead all events have the field env=dev.

My transforms.conf looks like:

[mylookup]
filename = lookup.csv
time_field = timestamp
time_format = %Y-%m-%d %H:%M:%S
default_match = unknown
case_sensitive_match = false

Is this expected? Is there another way to achieve what I'm looking for?

Thanks

Tags (1)
1 Solution

Stephen_Sorkin
Splunk Employee
Splunk Employee

The stanza above should be in transforms.conf, since it defines the lookup table. To make it apply for a given sourcetype, you should add to props.conf:

[<sourcetype>]
LOOKUP-env = mylookup host OUTPUT env

Editing to include new findings:

  1. I can't reproduce the problem using time_format and rendered time, provided I change it to 2011, not 2010 (I haven't tried with 2010).
  2. It works if I use UTC epoch time, like 1298942760,host1,dev and take out the time_format attribute in transforms.conf.

Are you sure that you're looking at data from 2010 and not 2011?

View solution in original post

Stephen_Sorkin
Splunk Employee
Splunk Employee

The stanza above should be in transforms.conf, since it defines the lookup table. To make it apply for a given sourcetype, you should add to props.conf:

[<sourcetype>]
LOOKUP-env = mylookup host OUTPUT env

Editing to include new findings:

  1. I can't reproduce the problem using time_format and rendered time, provided I change it to 2011, not 2010 (I haven't tried with 2010).
  2. It works if I use UTC epoch time, like 1298942760,host1,dev and take out the time_format attribute in transforms.conf.

Are you sure that you're looking at data from 2010 and not 2011?

craigmunro
Path Finder

Yes, that did it. Changing to the correct year (!) and using UTC time everything now works.

Thanks!

craigmunro
Path Finder

Thanks Stephen, actually the stanza is in transforms.conf and I have the correct entry in props.conf I've corrected my question.

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...