Splunk Operational Intelligence Cookbook - Third Edition

Manually adding the lookup to Splunk

Follow the given steps to manually add the lookup to Splunk:

1. Upload your productdescriptions.csv file to $SPLUNK_HOME/etc/apps/operational_intelligence/lookups directory (create the lookups directory if required)
2. Add the following stanza to $SPLUNK_HOME/etc/apps operational_intelligence/local/transforms.conf (create the local directory if required):

[Product_Descriptions] 
filename = productdescriptions.csv 

3. Add the following stanza to $SPLUNK_HOME/etc/apps operational_intelligence/local/props.conf (create the local directory if required):

[log4j] 
LOOKUP-Product_Descriptions = Product_Descriptions itemId  AS itemId OUTPUTNEW itemDescription AS ProductDescription,  itemName AS ProductName