I had a question about the csvlookup app for Splunk. I recently installed the app on one of our dev search heads and it works great. By default, it stores and finds lookups from the /export/opt/s...
...p a [status] lookup with the following field definition:
"host","Error_Message","Error_Status","Time_Acknowledged"
The idea is that an administrator then uses a Workflow action to output the f...
...Now I want to automate this as good as possible and thought about the following solution:
a) Configure Splunk to monitor a folder in which I'd copy the new XML-file once it has undergone one or m...
Hello,
Anyone knows if we can use eval-ingest with lookup command in Splunk Cloud?
The problem is that in Splunk Cloud we can only add configuration via custom app in SH.
Eval-ingest in g...
...itre_data_sources.csv` lookup located at `$SPLUNK_HOME/etc/apps/Splunk_Security_Essentials/lookups/mitre_data_sources.csv` ## Clean Install - First 5 Id Name Data_Source Description Data_Component D...
Hello,
I have 2 csv files created using outputcsv. Because of their size (500K records +) AND because they are really data sources and not true lookups (requiring bundle replication) outputcsv a...
Hi, Under lookups we have lookups as below lookups abcd.csv xyz.csv I could see configs in props.conf to map to these lookups props.conf LOOKUP-field1-field2 = abcd_lookup field OUTPUTNEW f...
...hich are not being used. We are using the "policy_id" column in the lookupcsv:
index="summary" policy_id=*
| inputlookup append=t policywithdescs
| rename PolicyID as policy_id
| stats count b...
...Add_a_lookup_stanza_to_transforms.conf (and on through the other steps)
So I have a csv file under $SPLUNK_HOME/etc/apps/search/lookups/users.csv
The format of the file is
user,"full_name"
u...
I know that using inputlookup will use a CSV file but is it possible to have a script create the CSV file that inputlookup will use?
I know I can use a scripted lookup but this requires a...