Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- splunk lookup not working!
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
splunk lookup not working!
Hi, I just created a static CSV file for the splunk lookup. But when I upload it, it didn't appear in the pick field. I follow the exact same step in the tutorial but it just didn't work out.
My CSV file has:
DestinationIP,owner_id,owner
118.214.191.45,1,Noam Freedman
209.85.175.106,2,Google Inc.
66.220.149.32,3,Facebook Inc.
124.155.223.9,4,NOC SHI
I would like the splunk to display whenever they lookup the IP address they would know the name of the owner. The destination ip address is already in my log file.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
your pipe as in the key next to the right closing square brackets which you have to use when you do a stats command or an eval command.
give us an example (paste the search command) of your search string and let us see if you're doing the right thing?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
[Website1.zip:./Website/Website]
LOOKUP-find_owner_name = find_owner_name DestinationIP AS DestinationIP OUTPUTNEW owner AS owner owner_id AS owner_id
the above one is under props.conf
[find_owner_name]
filename = find_owner_name.csv
and this one is under transforms.conf
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
what do you mean by my pipe?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What did you have in your pipe to lookup command for input and output?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
yeap is inside already. But it didn't work at all. I can't seems to find it in the pick field.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Did you verify the file exists in the users folder ? Example : /opt/splunk/etc/users/admin/search/lookups/
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
