Lookups

Question 1

What is the function of a lookup?

Answer 1

Allows you to add values to your events not included in the indexed data

Question 2

Are lookup fields case sensitive?

Answer 2

Yes

Question 3

How do you start a new lookup i.e. which menus

Answer 3

Settings, Lookups, Add New

Question 4

What is the purpose of ‘Automatic Lookup’

Answer 4

It means you don’t have to ‘define’ a lookup in your search, you can use predefined search

Question 5

Give an example of a manual lookup

Answer 5

Sourcetype=access_combined NOT status=200 | lookup http_status as status, OUTPUT code as “HTTP Code”, description as “HTTP Descritpion”

Question 6

Given an example of an automatic lookup for the same as the last quesetion

Answer 6

Sourcetype=access_combined NOT status=200 | table host, “Code’, “Description”