Implementing Splunk 7, Third Edition - Third Edition

Lookup definitions

A simple lookup simply needs to specify a filename in transforms.conf, as shown here:

[testlookup] 
filename = test.csv 

Assuming that test.csv contains the user and group columns and our events contain the user field, we can reference this lookup using the lookup command in search, as follows:

* | lookup testlookup user 

Otherwise, we can wire this lookup to run automatically in props.conf, as follows:

[mysourcetype] 
LOOKUP-testlookup = testlookup user 

That's all you need to get started, and this probably covers most cases. See the Using lookups to enrich data section in Chapter 7, Extending Search, for instructions on creating lookups.