Using Lookups in Splunk
We all know, lookups are very useful in enhancing the your original event data. It will add key value pairs to your existing event to make more sense of your data.
We all know, lookups are very useful in enhancing the your original event data. It will add key value pairs to your existing event to make more sense of your data. Let’s dive into below topic on how to use CSV lookups.
Limitations the csv files:
There are some restrictions to the files that can be used for CSV lookups.
- The table in the CSV file should have at least two columns. One column represents a field with a set of values that includes values belonging to a field in your events. The column does not have to have the same name as the event field. Any column can have multiple instances of the same value, which is a multivalued field.
- The characters in the CSV file must be plain ASCII text and valid UTF-8 characters. Non-UTF-8 characters are not supported.
- CSV files cannot have “\r” line endings (OSX 9 or earlier)
- CSV files cannot have header rows that exceed 4096 characters.
Upload the lookup table file: To use a lookup table file, you must upload the file to your Splunk platform. Steps
- SelectSettings > Lookupsto go to the Lookups manager page.
- In the Actions column, clickAdd newnext toLookup table files.
- Select a Destination app from the list. Your lookup table file is saved in the directory where the application resides. For example: $SPLUNK_HOME/etc/users/<username>/<app_name>/lookups/.
- ClickChoose Fileto look for the CSV file to upload. The Splunk software saves your CSV file in$SPLUNK_HOME/etc/system/lookups/, or in$SPLUNK_HOME/etc/<app_name>/lookups/if the lookup belongs to a specific app.
- Enter the destination filename. This is the name the lookup table file will have on the Splunk server. If you are uploading a gzipped CSV file, enter a filename ending in “.gz”. If you are uploading a plaintext CSV file, use a filename ending in “.csv”.
Share a lookup table file with apps: After you upload the lookup file, tell the Splunk software which applications can use this file. The default app is Launcher.
- SelectSettings > Lookups.
- From the Lookup manager, clickLookup table files.
- ClickPermissionsin the Sharing column of the lookup you want to share.
- In the Permissions dialog box, underObject should appear in, selectAll appsto share globally. If you want the lookup to be specific to this app only, selectThis app only. You can also keep your lookup private by selectingKeep private.