automatic lookups

[a212830]

Hi,

I configured a lookup that works fine, if I explicitly use the lookup statement in my search, but I want the field to auto-populate, based upon the sourcetype. Is there a way to do this?

[kristian_kolb · Accepted solution]

As Ayn states, this can be done with a LOOKUP-statement in props.conf, but you also need the corresponding transforms.conf stanza to make it work. I recently posted an answer to this type of question;

http://splunk-base.splunk.com/answers/5916/using-cidr-in-a-lookup-table?page=1&focusedAnswerId=46866...

Have a look, and if you don't figure it out, feel free to provide more information regarding what you're trying to do.

Hope this helps,

Kristian

[Ayn]

Yes, you set this in props.conf using the LOOKUP directive. For instance

[mysourcetype]
LOOKUP-foo = mylookuptable somefield OUTPUT somelookedupfield

http://docs.splunk.com/Documentation/Splunk/4.3/admin/Propsconf

[a212830]

Did that - doesn't work.

LOOKUP-hostdb = hostdb_lookup srcIP OUTPUTNEW deviceName

[AllenZhang]

needs restart to make it work?