Next, we check the availability of the lookup definition we added by going to Settings → Lookups → Lookup Definition.
We do this by again going to Settings → Lookups → Lookup Definition → Add New. Create Lookup Definitionsįor a search query to be able to lookup values from the Lookup file we just uploaded above, we need to create a lookup definition. On clicking the save button, the file gets saved to the Splunk repository as a lookup file. We also keep the same destination file name. We browse to select the file productidvals.csv as our lookup file to be uploaded and select search as our destination app. We select lookup table files as shown below. Next, we add the lookup file to Splunk environment by using the Settings screens as shown below −Īfter selecting the Lookups, we are presented with a screen to create and configure lookup. Here, we have kept the name of the first field as productid which is same as the field we are going to use from the dataset. We create a lookup file with the following details. This field is just a number, but we want product names to be reflected in our query result set. We consider the dataset with host as web_application, and look at the productid field. In order to successfully create a lookup field in a dataset, we need to follow the below steps − Create Lookup File The advantage is, we retrieve the related values from two different data sets. Such linking of values of one field to a field with same name in another dataset using equal values from both the data sets is called a lookup process. But if we list the product name along with the product id, that gives us a good report where we understand the meaning of the search result. These numbers will not give us any idea of what kind of product it is. For example, we may get a field which lists the value of product id as a numeric result. In the result of a search query, we sometimes get values which may not clearly convey the meaning of the field.
0 kommentar(er)
