Mastering Splunk

Chapter 4. Lookups

This chapter will discuss Splunk lookups and workflows. The topics that will be covered in this chapter are as follows:

• The value of a lookup
• Design lookups
• File lookups
• Script lookups

Introduction

Machines constantly generate data, usually in a raw form that is most efficient for processing by machines, but not easily understood by "human" data consumers. Splunk has the ability to identify unique identifiers and/or result or status codes within the data. This gives you the ability to enhance the readability of the data by adding descriptions or names as new search result fields. These fields contain information from an external source such as a static table (a CSV file) or the dynamic result of a Python command or a Python-based ...