Using extracted fields in automatic lookups

[joshua_hart]

I have a series of fields I've extracted using the GUI for a particular sourcetype. I've also set up a lookup table, definition, and automatic lookup using one of those fields. The automatic lookup is supposed to add a field from the lookup table. However, I cannot get it to work with fields that have been extracted using the GUI. Is there something I'm missing? Automatic lookups work just fine on sourcetypes with fields that have been automatically extracted (ie, they arrive at Splunk as "key=value" pairs and require no additional extraction).

Any hints?

[davecroto]

First add an entry in $SPLUNK_HOME/etc/systems/local/transforms.conf:

[alookupexample]
filename=mycsvfile.csv

Then either restart splund or do a | extract reload=t then run a search like the one below:

somesearch | lookup alookupexample <oneofthefieldsyouextractedviagui> OUTPUT <oneofthefieldsinthelookup)in_the_lookup>

oneofthefieldsyouextractedviagui above needs to be the first column of the csv lookup

make sure you are looking at all the interesting fields on the right (blue) of the screen

After you've confirmed that that works put in the correct stanza inside of the props.conf file.

[joshua_hart1]

So, I ran the search manually with the lookup and I was able to match fields in the search with fields in the lookup, but the OUTPUT field was not...output. No dice. But, thanks.

[lukejadamec]

search | extract | lookup

[lukejadamec]

Have you tested the lookup by applying it manually after a search that extracts the fields?