Use lookup to add fields from lookup tables
You can match fields in your events to fields in external sources, such as lookup tables, and use these matches to add more information inline to your events.
A lookup table can be a static CSV file, a KV store collection, or the output of a Python script. You can also use the results of a search to populate the CSV file or KV store collection and then set that up as a lookup table. For more information about field lookups, see Configure CSV and external lookups and Configure KV store lookups in the Knowledge Manager Manual.
After you configure a fields lookup, you can invoke it from the Search app with the
You have a field lookup named
dnslookup which references a Python script that performs a DNS and reverse DNS lookup and accepts either a host name or IP address as arguments. You can use the
lookup command to match the host name values in your events to the host name values in the lookup table, and add the corresponding IP address values to your events.
... | lookup dnslookup clienthost AS host OUTPUT clientip
- Related information
- Configure external lookups in the Knowledge Manager Manual
Use the eval command and functions
Extract fields with search commands
This documentation applies to the following versions of Splunk Cloud™: 7.0.13, 7.2.9, 7.2.10, 8.0.2006, 8.0.2007, 8.1.2008, 8.1.2009, 8.1.2011, 8.1.2012 (latest FedRAMP release), 8.1.2101, 8.1.2103, 8.2.2104, 8.2.2105