Creating lookups
We explored what a lookup is and some of its types in the Understanding fields and lookups section. Lookups in Splunk are crucial for enriching and correlating data, enabling efficient analysis and advanced search capabilities. In this section, we are going to create CSV and KV Store lookup files using Splunk Web.
As an example, we will use a lookup of country codes to country names as follows. If you recall the callrecords sample from the previous section, the data contains phone numbers with country codes, but we can’t find out the origin country of the phone numbers from callrecords Splunk events alone. In order to obtain the country name from the country code, the knowledge managers or data administrators create additional lookups. The lookup can be further used in Splunk queries to correlate country codes with the lookup and retrieve country names from it.
Save the following contents in a file as phone_no_country_code_to_name.csv in your local system...
