
Define an automatic lookup in Splunk Web
Manual lookups are applied to the results of a search when they are invoked with the lookup
command. Automatic lookups are applied to all searches at search time.
Splunk software does not support nested automatic lookups.
Add a new lookup to run automatically
Prerequisites
Review the following topics:
- Lookups and the search-time operations sequence for field lookup restrictions
- Define a CSV lookup in Splunk Web
- Define an external lookup in Splunk Web
- Define a KV Store lookup in Splunk Web
- Define a geospatial lookup in Splunk Web
- An example lookup in Splunk Web
A lookup definition that you have defined previously.
Steps
- In Splunk Web, select Settings > Lookups.
- Under Actions for Automatic Lookups, click Add new.
- Select the Destination app.
- Give your automatic lookup a unique Name.
- Select the Lookup table that you want to use in your fields lookup.
- This is the name of the lookup definition that you defined on the Lookup Definition page.
- In the Apply to menu, select a host, source, or source type value to apply the lookup and give it a name in the named field.
- Under Lookup input fields provide one or more pairs of input fields.
- The first field is the field in the lookup table that you want to match. The second field is a field from your events that matches the lookup table field. For example, you can have an
ip_address
field in your events that matches anip
field in the lookup table. So you would enterip = ip_address
in the automatic lookup definition.
- The first field is the field in the lookup table that you want to match. The second field is a field from your events that matches the lookup table field. For example, you can have an
- Under Lookup output fields provide one or more pairs of output fields.
- The first field is the corresponding field that you want to output to events. The second field is the name that the output field should have in your events. For example, the lookup table may have a field named
country
that you may want to output to your events asip_city
. So you would entercountry=ip_city
in the automatic lookup definition.
- The first field is the corresponding field that you want to output to events. The second field is the name that the output field should have in your events. For example, the lookup table may have a field named
- You can select the checkbox for Overwrite field values to overwrite the field values when the lookup runs.
Note: This is equivalent to configuring your fields lookup inprops.conf
. - Click Save.
The Automatic lookup view appears, and the lookup that you have defined is listed.
PREVIOUS Define a time-based lookup in Splunk Web |
NEXT Lookup example in Splunk Web |
This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.1.0, 8.0.7, 8.1.1
Feedback submitted, thanks!