Implementing Splunk 7, Third Edition - Third Edition

Defining an automatic lookup

Automatic lookups are, in the author's opinion, one of the coolest features in Splunk. Not only are the contents of the lookup added to events as if they were always there, but you can also search against the fields in the lookup file as if they were part of the original event.

To define the automatic lookup, navigate to Settings | Lookups | Automatic lookups and click on the New button:

Let's step through the fields in this definition:

• Destination app: This is the application where the definition will live. We'll discuss the implications of this choice in Chapter 8, Working with Apps.
• Name: This name is used ...