Implementing Splunk: Big Data Reporting and Development for Operational Intelligence

Writing a scripted lookup to enrich data

We covered CSV lookups fairly extensively in Chapter 6, Extending Search, then touched on them again in Chapter 9, Summary Indexes and CSV Files and Chapter 10, Configuring Splunk. The capabilities built into Splunk are usually sufficient, but sometimes it is necessary to use an external data source or dynamic logic to calculate values. Scripted lookups have the following advantages over commands or CSV lookups:

• Scripted lookups are only run once per unique lookup value, as opposed to a command, which would run the command for every event
• The memory requirement of a CSV lookup increases with the size of the CSV file
• Rapidly changing values can be left in an external system and queried using the scripted lookup ...