Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- automatic lookups
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
As Ayn states, this can be done with a LOOKUP-statement in props.conf, but you also need the corresponding transforms.conf stanza to make it work. I recently posted an answer to this type of question;
Have a look, and if you don't figure it out, feel free to provide more information regarding what you're trying to do.
Hope this helps,
Kristian
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
As Ayn states, this can be done with a LOOKUP-statement in props.conf, but you also need the corresponding transforms.conf stanza to make it work. I recently posted an answer to this type of question;
Have a look, and if you don't figure it out, feel free to provide more information regarding what you're trying to do.
Hope this helps,
Kristian
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, you set this in props.conf using the LOOKUP directive. For instance
[mysourcetype]
LOOKUP-foo = mylookuptable somefield OUTPUT somelookedupfield
http://docs.splunk.com/Documentation/Splunk/4.3/admin/Propsconf
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Did that - doesn't work.
LOOKUP-hostdb = hostdb_lookup srcIP OUTPUTNEW deviceName
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
needs restart to make it work?
Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 4)
From GPU to Application: Monitoring Cisco AI Infrastructure with Splunk Observability ...
Application management with Targeted Application Install for Victoria Experience
