Splunk Search

What is the difference between action.lookup and action.populate_lookup?

ruman_splunk
Splunk Employee
Splunk Employee

https://docs.splunk.com/Documentation/Splunk/latest/admin/savedsearchesconf mentions two lookup-generating actions: action.lookup and action.populate_lookup.

Some of the differences are clear, though not explicitly listed, in the docs. What's the complete set of differences? When should I use one or the other and when do I have to use outputlookup?

action.lookup = <boolean>
* Specifies whether the lookup action is enabled for this search.
* Default: false

action.lookup.filename = <lookup filename>
action.lookup.append = <boolean>

and

action.populate_lookup = <boolean>
* Specifies whether the lookup population action is enabled for this search.
* Default: false

action.populate_lookup.dest = <string>
run_on_startup = <boolean>
run_n_times = <unsigned integer> 

 

Labels (1)
0 Karma
1 Solution

ruman_splunk
Splunk Employee
Splunk Employee
  • appending
    • action.lookup allows for appending.
    • action.populate_lookup does not.
  • specifying a target lookup
    • action.lookup requires a filename (relative to the current app).
    • action.populate_lookup allows you to specify a transforms stanza or path for the lookup, and allows you to update a lookup in some other app or in etc/system/lookups.
  • limits
    • action.lookup has a 50K row limit.
    • action.populate_lookup does not have a limit.
  • scheduling
    • action.populate_lookup has additional scheduling options run_on_startup and run_n_times.

See also: https://community.splunk.com/t5/Splunk-Search/quot-outputlookup-quot-vs-quot-action-populate-lookup-...

So, you can't use savedsearches.conf to configure a lookup action if you need to append more than 50K results - must use outputlookup in this case.

View solution in original post

0 Karma

ruman_splunk
Splunk Employee
Splunk Employee
  • appending
    • action.lookup allows for appending.
    • action.populate_lookup does not.
  • specifying a target lookup
    • action.lookup requires a filename (relative to the current app).
    • action.populate_lookup allows you to specify a transforms stanza or path for the lookup, and allows you to update a lookup in some other app or in etc/system/lookups.
  • limits
    • action.lookup has a 50K row limit.
    • action.populate_lookup does not have a limit.
  • scheduling
    • action.populate_lookup has additional scheduling options run_on_startup and run_n_times.

See also: https://community.splunk.com/t5/Splunk-Search/quot-outputlookup-quot-vs-quot-action-populate-lookup-...

So, you can't use savedsearches.conf to configure a lookup action if you need to append more than 50K results - must use outputlookup in this case.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...