Where to download lookup file related to sales index (retail sales) used in search tutorial ?

[Ombessam]

count retail sales events for strategy games

I can't find categoryId field by default from the search tutorial data. It has been added by a lookup file but I don't know where can I download it.

Can anyone help help this ? Thanks

[ITWhisperer · Accepted solution]

categoryId is not used in the vendor_sales sourcetype - try looking in the access_combined_wcookie sourcetype (there is no additional lookup for this information).

[Ombessam]

@ITWhisperer  you're right, the correct source type is  access_combined

 

[isoutamo]

Tutorial data can found from https://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/Systemrequirements#Download_the_t...