Splunk Fundamentals 1 Lab Exercises: Lab Module 12 - Creating Lookups
Splunk Fundamentals 1 Lab Exercises: Lab Module 12 - Creating Lookups
NOTE: Lab work will be done on your personal computer or virtual machine, no lab environment is
provided. We suggest you DO NOT do the lab work on your production environment.
The lab instructions refer to these source types by the types of data they represent:
Type Sourcetype Fields of interest
Web Application access_combined_wcookie action, bytes, categoryId, clientip,
itemId, JSESSIONID, productId,
referer, referer_domain, status,
useragent, file
NOTE: This lab document has two sections. The first section includes the instructions without answers.
The second section includes instructions with the expected search string (answer) in red.
Description
In this lab exercise, you will create a new automatic lookup that provides additional information for Buttercup
Games products.
Scenario: The web application data does not contain name and price information for the products being
sold. Users of your reports would like to see product names used in your reports, not just product
Ids.
NOTE: For this course, you will be searching across all time using the main index. This is NOT a best
practice in a production environment, but needed for these labs due to the nature of the limited
dataset.
Search the web application data for all events where a user purchased a product successfully.
Use the lookup command and reference the lookup table you just created. Match the productId in
lookup table to the productId field in the event data. Use the OUTPUT function to output the
product_name lookup table data to a ProductName field.
Notice that there is now a ProductName field in the fields list.
Example:
Change the search to use a stats count function to count events by ProductName.
Example Results:
NOTE: Lab work will be done on your personal computer or virtual machine, no lab environment is
provided. We suggest you DO NOT do the lab work on your production environment.
The lab instructions refer to these source types by the types of data they represent:
Type Sourcetype Fields of interest
Web Application access_combined_wcookie action, bytes, categoryId, clientip,
itemId, JSESSIONID, productId,
referer, referer_domain, status,
useragent, file
NOTE: This lab document has two sections. The first section includes the instructions without answers.
The second section includes instructions with the expected search string (answer) in red.
Description
In this lab exercise, you will create a new automatic lookup that provides additional information for Buttercup
Games products.
Scenario: The web application data does not contain name and price information for the products being
sold. Users of your reports would like to see product names used in your reports, not just product
Ids.
NOTE: For this course, you will be searching across all time using the main index. This is NOT a best
practice in a production environment, but needed for these labs due to the nature of the limited
dataset.
Search the web application data for all events where a user purchased a product successfully.
(index=main sourcetype=access_combined_wcookie status=200 file=success.do)
Use the lookup command and reference the lookup table you just created. Match the productId in
lookup table to the productId field in the event data. Use the OUTPUT function to output the
product_name lookup table data to a ProductName field.
(index=main sourcetype=access_combined_wcookie status=200 file=success.do | lookup products_lookup
productId as productId OUTPUT product_name as ProductName)
Notice that there is now a ProductName field in the fields list.
Example:
Change the search to use a stats count function to count events by ProductName.