Please tell me about the lookup operation. 1. when you register a new lookup table file (CSV) from the GUI, you can immediately refer to it on the search screen.　   | inputlookup “lookup.csv”   However, it does not appear in the list of files in the “Lookup File” pull-down on the next Create New Lookup Definition screen. It takes time to set up because it appears after more than one day each time. Is this due to a limitation caused by the specifications? If you know the cause, please let us know.    2. no lookup The following CSV file is registered, and lookup definitions and automatic definitions are also set. 【lookup.csv】   PC_Name | Status | MacAddr1 | MacAddr2 ------------------------------------------------------------ PC_Name1 | Used | aa:bb:cc...　| zz:yy:xx... PC_Name2 | Used | aa:bb:cc...　| zz:yy:xx... PC_Name3 | Used | aa:bb:cc... | zz:yy:xx...   *MacAddr1 and MacAddr2 by Ethernet and WiFi Address,　I want to refer to MacAddr2 as a key. The following fields are output in the target index log CL_MacAddr as defined in the calculated field I would like to reference the Mac address of this CL_MacAddr from lookup.csv and output PC_Name and Status as fields, but it is not working. For example, when I enter the following in the search screen, only the existing fields appear, not PC_Name, Status, etc. index=“nc-wlx402” sourcetype=“NC-WIFI-3” | lookup “lookup.csv” MACAddr2 AS CL_MacAddr OutputNew   However, another lookup definition is available for the same index and source type (automatic definition setting, confirmed operation). I'm assuming this is due to something basic... please help me ... View more

Please tell me how to make the output replace some characters in the field definitions. Specifically, the problem is that the following two formats of Mac Address in multiple logs imported into Splunk are mixed. AA:BB:CC:00:11:22 AA-BB-CC-00-11-22 I would like to unify the MacAddress field in the log in the form of “AA:BB:CC:00:11:22” in advance, because I would like to link the host name from MacAddress in the automatic definition of LookUpTable. Put the following in the search field and output the modified one as “MacAddr”, index=“Log” | rex ^. +? \scli\s}? <CL_MacAddr>. +? (. +?)) \) | eval MacAddr = replace(CL_MacAddr,“-”,“:”) Alternatively, we could replace the existing field “CL_MacAddr” with a modified version as follows. index=“Log” | rex mode=sed field=“CL_MacAddr” “s/-/:/g” I am trying to set this in the GUI's field extraction and field transformation to always have the modified superscript, but it does not work. Or can it be set directly in transforms.conf, but in this case, what values can be set and where? I know this is basic, but I would appreciate your help. Thank you in advance. ... View more