Splunk Search

How to create a lookup table

ngox0061
Explorer

I'm new to Splunk and was wondering how to do a lookup table.  So what i'm trying to get is something like a lookup of: 

index=_internal* log_level=WARN OR log_level=ERR host=XPxx9* OR host=GPxx7* OR host=fsr*

 

but instead of listing like 30 of the host names with OR arguments, what's the ideal way to do it? can someone provide examples?

Labels (2)
1 Solution

richgalloway
SplunkTrust
SplunkTrust

There are a few ways to create a lookup table, depending on your access.

  • Use the CLI to create a CSV file in an app's lookups directory
  • Use the Lookup File Editor app to create a new lookup
  • Go to Settings->Lookups and click "Add new" next to "Lookup table files".  Then fill in the form and upload a file.
  • Create a search and save the results using the | outputlookup command.
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

When I suspect a lookup file is populated by a saved search, I use this CLI command to find it.

find /opt/splunk/etc/apps -name savedsearches.conf -print0 | xargs -r0 grep -i "outputlookup mylookup.csv"

Yes, I do give karma to good answers.

---
If this reply helps you, an upvote would be appreciated.

inventsekar
Super Champion

Hi @richgalloway .. that find command solution is very intelligent(far better than searching splunk settings and the 100 options 😉 )

 

>> Yes, I do give karma to good answers. 

oops, my signature line is meant for all others/the recent day new members. Definitely not for you. in these 5 years i have seen your solutions and i can never say such karma points comments to You. thanks. 

 

(i have given around 300 karma points so far, received badge for that,.. maybe you also should give karma points if a/any post helped you, thx)

>>> Happy Splunking !
0 Karma

richgalloway
SplunkTrust
SplunkTrust

There are a few ways to create a lookup table, depending on your access.

  • Use the CLI to create a CSV file in an app's lookups directory
  • Use the Lookup File Editor app to create a new lookup
  • Go to Settings->Lookups and click "Add new" next to "Lookup table files".  Then fill in the form and upload a file.
  • Create a search and save the results using the | outputlookup command.
---
If this reply helps you, an upvote would be appreciated.

inventsekar
Super Champion

Hi @richgalloway ...

outputlookup // i got a simple issue, but, somehow i could not find the solution from my top of my mind.

lets say i already have a lookup created and working fine(by my old teammate). aftersometime i would like to know how the csv file gets created. when i went to settings-->lookup, i dont see which search query creates the csv file. i think a saved search only uses that outputlookup command and creates that csv file. 

this far only my mind works and i am not sure how to proceed further. pls suggest. thanks. 

(i have given around 300 karma points so far, received badge for that,.. maybe you also give karma points if a/any post helped you, thx)

>>> Happy Splunking !
0 Karma

ngox0061
Explorer

I will try and follow your directions and give it a shot.  Thanks, richgalloway!

0 Karma