Splunk Search

lookup against an extracted field

vbumgarner
Contributor

Is it possible to have a lookup table keyed off of an extracted field?

Given the props:

[foo]
EXTRACT-bu = ^(?<bu>.{5})\- in host
LOOKUP-bu = bu_fields bu

and the transforms:

[bu_fields]
filename = buFields.csv

Should this work?

I believe the lookuptable is there, because this works as expected:

sourcetype="foo" | lookup bu_fields bu

gkanapathy
Splunk Employee
Splunk Employee

Yes of course. In fact almost all fields are extracted, so this is what lookups normally do. Generally, the order at search time is:

  1. KV_MODE
  2. EXTRACT
  3. REPORT
  4. FIELDALIAS
  5. LOOKUP

bwooden
Splunk Employee
Splunk Employee

This answer was written before calculated fields. Now that we have calculated fields: 4.5 = EVAL (calculated fields)

0 Karma

vbumgarner
Contributor

I think an indexed field is the answer in this case.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

or by using where or search after the initial search, or by creating an indexed field.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

well, actually, are you trying to do a reverse lookup? that won't work if the extracted value is not from the _raw field, and yours is from host. the forward lookup should work okay though. You can make it work with much-diminished performance by setting INDEXED_VALUE = false in fields.conf for the bu field.

0 Karma

vbumgarn
Path Finder

Yeah, I've made it work with another test, so something is weird in that config.

Looks like I'll need to make an indexed field out of bu if I want to search against the fields in the lookup, though.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...