Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: automatic lookups
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
As Ayn states, this can be done with a LOOKUP-statement in props.conf, but you also need the corresponding transforms.conf stanza to make it work. I recently posted an answer to this type of question;
Have a look, and if you don't figure it out, feel free to provide more information regarding what you're trying to do.
Hope this helps,
Kristian
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
As Ayn states, this can be done with a LOOKUP-statement in props.conf, but you also need the corresponding transforms.conf stanza to make it work. I recently posted an answer to this type of question;
Have a look, and if you don't figure it out, feel free to provide more information regarding what you're trying to do.
Hope this helps,
Kristian
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, you set this in props.conf using the LOOKUP directive. For instance
[mysourcetype]
LOOKUP-foo = mylookuptable somefield OUTPUT somelookedupfield
http://docs.splunk.com/Documentation/Splunk/4.3/admin/Propsconf
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Did that - doesn't work.
LOOKUP-hostdb = hostdb_lookup srcIP OUTPUTNEW deviceName
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
needs restart to make it work?
Enter the Agentic Era with Splunk AI Assistant for SPL 1.4
Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...
Accelerating Observability as Code with the Splunk AI Assistant
