We covered CSV lookups fairly extensively in Chapter 6, Extending Search, then touched on them again in Chapter 9, Summary Indexes and CSV Files and Chapter 10, Configuring Splunk. The capabilities built into Splunk are usually sufficient, but sometimes it is necessary to use an external data source or dynamic logic to calculate values. Scripted lookups have the following advantages over commands or CSV lookups:
Scripted lookups are only run once per unique lookup value, as opposed to a command, which would run the command for every event
The memory requirement of a CSV lookup increases with the size of the CSV file
Rapidly changing values can be left in an external system and queried using the scripted lookup instead of being exported frequently
In the Using a lookup with wildcards section in Chapter 9, Summary Indexes and CSV Files, we essentially created a case statement through configuration. Let's implement that use case as a script, just to show...
