Hi, I just created a static CSV file for the splunk lookup. But when I upload it, it didn't appear in the pick field. I follow the exact same step in the tutorial but it just didn't work out.
My CSV file has:
I would like the splunk to display whenever they lookup the IP address they would know the name of the owner. The destination ip address is already in my log file.
your pipe as in the key next to the right closing square brackets which you have to use when you do a stats command or an eval command.
give us an example (paste the search command) of your search string and let us see if you're doing the right thing?
LOOKUP-find_owner_name = find_owner_name DestinationIP AS DestinationIP OUTPUTNEW owner AS owner owner_id AS owner_id
the above one is under props.conf
filename = find_owner_name.csv
and this one is under transforms.conf