Hi, Under lookups we have lookups as below lookups abcd.csv xyz.csv I could see configs in props.conf to map to these lookups props.conf LOOKUP -field1-field2 = abcd _lookup field O...
Hi, In lookup definition, IT_server_list is created in lookup definition which is mapped to CSV named (server_list.csv) In Lookup Table, server_list.csv file is there In automatic lookup, I...
I am looking for some tool/way to get the Splunk index/lookup usage in the system
for example to get all lookups that are not used in the system
what is the best way to do it ?
...et of values from a field in a lookup table to act as a filter of events not to include it doesn't work no matter what I try. I've tried in the subsearch piping to: | rename field AS search | f...
Hi All, Is it possible to perform Eval then perform lookup ? If the eval return null then perform lookupA.csv. If eval return notnull, then perform lookupB.csv thanks!
...ountry_name and email from raw events versus to what is there in the csv file. Basically If the country_name in the raw events in DIFFERENT as in if it does not match the "Country" field in the lookup...
...ourcetype,index,_time span=1d I would like to modify it to run the search on only hosts which are in the lookup list servers.csv. Can you please help me with modification?
...vexpand email | stats count by email | eval useremail= email."@my_domain.com" | table useremail count | lookup userdomain_email email as useremail OUTPUT user as user But this g...