Splunk Search

how to perform lookups on summary index data

sonicZ
Contributor

I have a lookup on sourcetype=vipservices
csv file has values like so

jurhash, jurhasfriendlyname
somehashvalue, somehashvalue_friendly_name

Works fine when i am running the lookup on the sourcetype, but when i populate a summary index and try to use the lookup the sourcetype gets renamed to "Stash".

What's the best way to preserve sourcetype or reference original sourcetype for the existing lookup to use against the summary index?
Any other workarounds would work also

Thanks

Tags (2)
0 Karma
1 Solution

lguinn2
Legend

I've given a couple of options below, but I do have a question: what does your populating search look like? I assumed that you were using sistats ...

Option 1 - you could use the lookup command when you retrieve the data from the summary index

index=yoursummaryindex saved_search=yoursavedsearch 
| lookup yourlookupname jurhash OUTPUT juhasfriendlyname
| ... whatever you want to get out ...

Option 2 - put the lookup into the populating search (which I called yoursavedsearch in option 1):

sourcetype=vipservices | sistats whateverstats by whateverfields jushasfriendlyname 

and then the juhasfriendlyname will be stored, like any other field, in the summary index. You will not need to do the lookup when you retrieve the data from the summary index.

View solution in original post

sonicZ
Contributor

Our populating search was this btw:

index="vip" sourcetype=vipservices
  | transaction TR startswith="Operation Start" endswith="Operation End"
  | eval elapsed_wait=elapsed_operation-elapsed_request
  | sistats count, avg(elapsed_operation) as total-avg, perc80(elapsed_operation) as total-80, perc90(elapsed_operation) as total-90,
      perc95(elapsed_operation) as total-95, perc98(elapsed_operation) as total-98, perc99(elapsed_operation) as total-99,max(elapsed_operation) as total-max,
  avg(elapsed_responder) as resp-avg, max(elapsed_responder) as resp-max,
  avg(elapsed_request) as req-avg, max(elapsed_request) as req-max,
  avg(elapsed_wait) as wait-avg, max(elapsed_wait) as wait-max
 by host, JURHASH, OP
0 Karma

lguinn2
Legend

I've given a couple of options below, but I do have a question: what does your populating search look like? I assumed that you were using sistats ...

Option 1 - you could use the lookup command when you retrieve the data from the summary index

index=yoursummaryindex saved_search=yoursavedsearch 
| lookup yourlookupname jurhash OUTPUT juhasfriendlyname
| ... whatever you want to get out ...

Option 2 - put the lookup into the populating search (which I called yoursavedsearch in option 1):

sourcetype=vipservices | sistats whateverstats by whateverfields jushasfriendlyname 

and then the juhasfriendlyname will be stored, like any other field, in the summary index. You will not need to do the lookup when you retrieve the data from the summary index.

sonicZ
Contributor

option #1 worked, nice that you can call the lookup on demand. thanks very much!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...