Lookup example in Splunk Web

This example defines a file-based CSV lookup that adds two fields, status_description and status_type, to your web access events. This lets you search for events when you do not know the specific error code. Instead of searching for all server error codes, use status="Server Error".

Upload the lookup table to Splunk Enterprise

Prerequisities

• See Define a CSV lookup in Splunk Web.
• Download the http_status.csv file: http_status.csv file.
• Your role must have the upload_lookup_files capability. Without it you cannot upload lookup table files in Splunk Web. See Define roles with capabilities in Securing Splunk Enterprise.

The following is a sample of the file:

status,status_description,status_type
100,Continue,Informational
101,Switching Protocols,Informational
200,OK,Successful
201,Created,Successful
202,Accepted,Successful
203,Non-Authoritative Information,Successful
...

Steps

1. From the Search app, then select Settings > Lookups.
2. Select Add new for Lookup table files.
3. Select search for the destination app.
4. Browse for the CSV file that you downloaded earlier.
5. Name the lookup table http_status.
6. Click Save.




After Splunk Enterprise saves the file, it takes you to the following view:

Define the lookup

Prerequisites

• See Define a CSV lookup in Splunk Web.

Steps

1. From Settings > Lookups, select Add new for Lookup definitions.
2. Select search for the Destination app.
3. Name your lookup definition http_status.
4. Select File-based under Type.
5. Click Save.
   
   Notice there are some actions you can take on your lookup definition. Permissions lets you change the accessibility of the lookup table. You can Disable, Clone, and Move the lookup definition to a different app. Or, you can Delete the definition. Once you define the lookup, you can use the lookup command to invoke it in a search or you can configure the lookup to run automatically.

Set the lookup to run automatically

Prerequisites

• See Define an automatic lookup in Splunk Web

Steps

1. Return to the Settings > Lookups view and select Add new for Automatic lookups.
2. In the Add new page:
   
3. Select search for the Destination app.
4. Name the lookup http_status.
5. Select http_status from the Lookup table drop down.
6. Apply the lookup to the sourcetype named access_combined.
   
7. Lookup input fields are the fields in our events that you want to match with the lookup table. Here, both are named status (the CSV column name goes on the left and the field that you want to match goes on the right):
8. Lookup output fields are the fields from the lookup table that you want to add to your events: status_description and status_type. The CSV column name goes on the left and the field that you want to match goes on the right.
9. Click Save.