Splunk Search

What is the difference between action.lookup and action.populate_lookup?

ruman_splunk
Splunk Employee
Splunk Employee

https://docs.splunk.com/Documentation/Splunk/latest/admin/savedsearchesconf mentions two lookup-generating actions: action.lookup and action.populate_lookup.

Some of the differences are clear, though not explicitly listed, in the docs. What's the complete set of differences? When should I use one or the other and when do I have to use outputlookup?

action.lookup = <boolean>
* Specifies whether the lookup action is enabled for this search.
* Default: false

action.lookup.filename = <lookup filename>
action.lookup.append = <boolean>

and

action.populate_lookup = <boolean>
* Specifies whether the lookup population action is enabled for this search.
* Default: false

action.populate_lookup.dest = <string>
run_on_startup = <boolean>
run_n_times = <unsigned integer> 

 

Labels (1)
0 Karma
1 Solution

ruman_splunk
Splunk Employee
Splunk Employee
  • appending
    • action.lookup allows for appending.
    • action.populate_lookup does not.
  • specifying a target lookup
    • action.lookup requires a filename (relative to the current app).
    • action.populate_lookup allows you to specify a transforms stanza or path for the lookup, and allows you to update a lookup in some other app or in etc/system/lookups.
  • limits
    • action.lookup has a 50K row limit.
    • action.populate_lookup does not have a limit.
  • scheduling
    • action.populate_lookup has additional scheduling options run_on_startup and run_n_times.

See also: https://community.splunk.com/t5/Splunk-Search/quot-outputlookup-quot-vs-quot-action-populate-lookup-...

So, you can't use savedsearches.conf to configure a lookup action if you need to append more than 50K results - must use outputlookup in this case.

View solution in original post

0 Karma

ruman_splunk
Splunk Employee
Splunk Employee
  • appending
    • action.lookup allows for appending.
    • action.populate_lookup does not.
  • specifying a target lookup
    • action.lookup requires a filename (relative to the current app).
    • action.populate_lookup allows you to specify a transforms stanza or path for the lookup, and allows you to update a lookup in some other app or in etc/system/lookups.
  • limits
    • action.lookup has a 50K row limit.
    • action.populate_lookup does not have a limit.
  • scheduling
    • action.populate_lookup has additional scheduling options run_on_startup and run_n_times.

See also: https://community.splunk.com/t5/Splunk-Search/quot-outputlookup-quot-vs-quot-action-populate-lookup-...

So, you can't use savedsearches.conf to configure a lookup action if you need to append more than 50K results - must use outputlookup in this case.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>