Splunk LookupsIn this section we will learn about the Lookups in the Splunk platform. We will also learn what is lookup in Splunk, types of lookups, lookup table files, search command and lookup, operations in lookups. LookupsLookups expand our event data by adding variations of the field-value from the search tables. Splunk software uses lookups to match combinations of a field value in our event data with combinations of a field value in external lookup tables. If Splunk software finds these combinations of a field value in our search table, Splunk software adds the corresponding combinations of field value from the table to the table. Types of LookupsThere are four types of lookups:
In Splunk Web, we can create lookups through the Settings search pages. We can customize the lookups by editing the configuration files, whether we have Splunk Enterprise or Splunk Light, and we have access to the Splunk deployment configuration files. Lookup table filesThe files that contain a table of views are known as lookup table file. A standard lookup takes fields out of this table and adds them to our events when matching the respective fields in our events. All kinds of lookups use lookup tables, but only two types of lookups require us to upload a lookup table file. They are CSV lookups and geospatial lookups. Multiple lookup definitions can make use of a single lookup table file. For, e.g., say we have a file that provides the definitions of http status fields in the CSV lookup table. If we have events that include http status = 503, we can have a lookup that finds the 503 value for the http status field in the lookup table column and takes the corresponding status description value out of that lookup table. The lookup then adds status description = Service Non-available, Server Error to any http status = 503 events. Lookup definitionsThe definition of a lookup provides a name for the lookup and a path to find the table. The definitions of lookup can include additional settings such as matching rules, or restrictions on the fields that match the lookup in our Splunk platform. One lookup table can have definitions of multiple lookups. All types of lookups require a definition of the lookup. But this has to be done after we have created the lookup definition. Automatic lookupsTo apply automatic lookups to all searches at search time, use automatic lookups. After creating an automated search for a description of a search, we do not need to invoke it manually with the look-up button. Search commands and lookupsAfter defining and sharing our lookups with apps, we can interact with them via commands that are used for searching:
Lookups and the search-time operations sequenceSearch-time operation orderLookups are sixth in position in the search-time operation order and are processed before event types after calculated fields. RestrictionsThe Splunk software processes lookups in ASCII sort order that belong to a particular host, source, or source type. Lookup configurations can reference fields by field extractions, field aliases, and calculated fields added to events. They cannot reference the types and tags of the events. Define a CSV lookup in Splunk WebThe lookups that are file-based and match the field values in the static table represented by a CSV file from our events to field values. The output corresponding field values to our events from the table. They are often called static lookups. Lookups on CSV are best for small data sets. The general workflow to create a CSV lookup in Splunk Web is to upload a file, share the file for the lookup table, and then create the lookup definition from the file for the lookup table. CSV inline search table files, and inline search descriptions using CSV files, are both types of datasets. See Types and Use Dataset. Restrictions in CSV fileIn the lookups, there are a few restrictions that we can use in the CSV lookup.
Upload the lookup table fileWe must upload the file to our Splunk platform for the use of a lookup table file. Prerequisites:
Steps:
Share a table lookup file with apps:After uploading the lookup file, tell the Splunk software which applications are allowed to use this file. The default app for this is Launcher. Follow the steps given below to share a table lookup file with apps.
Create a CSV lookup definitionWe must use the lookup table file to create a lookup definition. PrerequisitesWe must share the lookup table file so that Splunk can see it, to create the lookup definition.
Our lookup is defined as a CSV file-based search and appears in the search definitions list. Share the lookup definition with appsAfter creating the definition for the lookup, specify which applications we want to use the definition in.
We can use this lookup field to add information to our events from the lookup table file. In a search string, we can use the field lookup with the searchup button. We can automatically set the field lookup to run for information about how to create an automatic lookup. Handle large CSV lookup tablesLookup tables are built on a search head and updated. The search head replicates to other search heads a new or modified lookup table or indexers for certain tasks.
Make the lookup automaticWe can set the lookup to run automatically instead of using the lookup command in our search when we want to apply a field lookup for our events.
Next TopicSplunk Alerts
|