Splunk Search

What is the difference between action.lookup and action.populate_lookup?

ruman_splunk
Splunk Employee
Splunk Employee

https://docs.splunk.com/Documentation/Splunk/latest/admin/savedsearchesconf mentions two lookup-generating actions: action.lookup and action.populate_lookup.

Some of the differences are clear, though not explicitly listed, in the docs. What's the complete set of differences? When should I use one or the other and when do I have to use outputlookup?

action.lookup = <boolean>
* Specifies whether the lookup action is enabled for this search.
* Default: false

action.lookup.filename = <lookup filename>
action.lookup.append = <boolean>

and

action.populate_lookup = <boolean>
* Specifies whether the lookup population action is enabled for this search.
* Default: false

action.populate_lookup.dest = <string>
run_on_startup = <boolean>
run_n_times = <unsigned integer> 

 

Labels (1)
0 Karma
1 Solution

ruman_splunk
Splunk Employee
Splunk Employee
  • appending
    • action.lookup allows for appending.
    • action.populate_lookup does not.
  • specifying a target lookup
    • action.lookup requires a filename (relative to the current app).
    • action.populate_lookup allows you to specify a transforms stanza or path for the lookup, and allows you to update a lookup in some other app or in etc/system/lookups.
  • limits
    • action.lookup has a 50K row limit.
    • action.populate_lookup does not have a limit.
  • scheduling
    • action.populate_lookup has additional scheduling options run_on_startup and run_n_times.

See also: https://community.splunk.com/t5/Splunk-Search/quot-outputlookup-quot-vs-quot-action-populate-lookup-...

So, you can't use savedsearches.conf to configure a lookup action if you need to append more than 50K results - must use outputlookup in this case.

View solution in original post

0 Karma

ruman_splunk
Splunk Employee
Splunk Employee
  • appending
    • action.lookup allows for appending.
    • action.populate_lookup does not.
  • specifying a target lookup
    • action.lookup requires a filename (relative to the current app).
    • action.populate_lookup allows you to specify a transforms stanza or path for the lookup, and allows you to update a lookup in some other app or in etc/system/lookups.
  • limits
    • action.lookup has a 50K row limit.
    • action.populate_lookup does not have a limit.
  • scheduling
    • action.populate_lookup has additional scheduling options run_on_startup and run_n_times.

See also: https://community.splunk.com/t5/Splunk-Search/quot-outputlookup-quot-vs-quot-action-populate-lookup-...

So, you can't use savedsearches.conf to configure a lookup action if you need to append more than 50K results - must use outputlookup in this case.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...