#SPLUNK LOOKUP SOFTWARE#

Lookups and the search-time operations sequence Search-time operation order We cannot use the outputlookupcommand with external lookups.

outputlookup: It is used to write fields in search results to a static lookup table file or KV store collection that we specify.

inputlookup: It is used to search the contents of a lookup table.

lookup: It is used to add fields to the events in the results of the search in the lookup.

Search commands and lookupsĪfter defining and sharing our lookups with apps, we can interact with them via commands that are used for searching: After creating an automated search for a description of a search, we do not need to invoke it manually with the look-up button. To apply automatic lookups to all searches at search time, use automatic lookups. But this has to be done after we have created the lookup definition. One lookup table can have definitions of multiple lookups.Īll types of lookups require a definition of the lookup. The definitions of lookup can include additional settings such as matching rules, or restrictions on the fields that match the lookup in our Splunk platform. The definition of a lookup provides a name for the lookup and a path to find the table. The lookup then adds status description = Service Non-available, Server Error to any http status = 503 events. If we have events that include http status = 503, we can have a lookup that finds the 503 value for the http status field in the lookup table column and takes the corresponding status description value out of that lookup table. Multiple lookup definitions can make use of a single lookup table file.įor, e.g., say we have a file that provides the definitions of http status fields in the CSV lookup table. They are CSV lookups and geospatial lookups. A standard lookup takes fields out of this table and adds them to our events when matching the respective fields in our events.Īll kinds of lookups use lookup tables, but only two types of lookups require us to upload a lookup table file. The files that contain a table of views are known as lookup table file.

We can customize the lookups by editing the configuration files, whether we have Splunk Enterprise or Splunk Light, and we have access to the Splunk deployment configuration files.

In Splunk Web, we can create lookups through the Settings search pages.

#SPLUNK LOOKUP SOFTWARE#

If Splunk software finds these combinations of a field value in our search table, Splunk software adds the corresponding combinations of field value from the table to the table. Splunk software uses lookups to match combinations of a field value in our event data with combinations of a field value in external lookup tables.

Lookups expand our event data by adding variations of the field-value from the search tables. We will also learn what is lookup in Splunk, types of lookups, lookup table files, search command and lookup, operations in lookups. In this section we will learn about the Lookups in the Splunk platform.

Splunk lookup