Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Which lookups are being used by ES?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Which lookups are being used by ES?
When looking at the set of lookups available for ES I see more than three hundreds of them. Which lookups are being used by ES and where is it documented?
There are many that are TA based, such as Splunk_TA_cisco-asa and Splunk_TA_bluecoat-proxysg. I assume they are being used to prepare the data for ES but not used directly by ES.
I see only six lookups which were created by ES, such as es_instrumentation_actions.csv and es_instrumentation_datamodels.csv.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
While it is documented (in different places that may not make a lot of sense), I would be more interested in the reason why you are asking this question? Do you think that ES lookups are breaking something in search? Are you just curious how ES works?
Why are you asking this question? If you can answer this, you might get more informative answers.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@jnudell_2 - I'm asking because I'm trying to understand ES.
It's interesting to see, for example, under security domains > endpoint > malware center, the New Infections panel which invokes a dynamic lookup -
| from inputlookup:malware_tracker | `dayDiff(firstTime)`
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I agree this could be better documented, but the answer is "it depends".
While there are a number of automatic lookups in ES, which other lookups are used depends on which correlation searches you run.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
the lookups are actually documented. The lookups you were talking about (from TAs) don't have anything to do with ES, as you guessed correctly. Here is a link to the docs: Manage internal lookups
Skalli
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Great, but the link appears to be broken.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The correct link is https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Manageinternallookups
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Fixed it, thanks. 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Still not fixed. Points to "http://manage+internal+lookups/" instead of "https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Manageinternallookups"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Answers is strange on the mobile sometimes. Thanks. 😄
Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain
Splunk Lantern’s Guide to The Most Popular .conf25 Sessions
Unlock What’s Next: The Splunk Cloud Platform at .conf25
