Enhancing logs with lookups

Lookups are very useful for enhancing search results. Lookups can be used to add extra clarifying information to search results. For example, we can use a lookup to convert HTTP status codes into user-readable strings. Given a username or ID, we can use a lookup containing additional information such as the user’s full name, manager, or department to add context to search results. The username or ID is piped from an earlier part of the search and used as a key to access the additional information in the lookup. In this section, we will explore the use of the inputlookup and lookup commands. The inputlookup command is a generating command. It is usually used with a lookup file that contains Comma-Separated Values (CSV). The Splunk Settings menu contains a link to all the lookups stored in Splunk. The following steps will guide you and show you the lookups available in the Splunk Addon for Microsoft Windows, which we installed in Chapter 2, Setting...