8.2 Creating Lookup Files and Definitions

From CSV on disk to a usable Splunk lookup

Topic 7.3 on the User blueprint is practical: create a lookup file and a lookup definition. In Splunk Web the home base is Settings > Lookups. That menu is where User-level questions expect you to navigate.

Under Settings > Lookups you will see (at minimum) these related areas:

Remember the split: the file is the data; the definition is the named configuration that tells Splunk how to use that data as a lookup.

Step 1 — Prepare a valid CSV

Before uploading, make sure the CSV is clean enough for Splunk to treat as a table:

• Include a header row with field names (status,status_description,status_type).
• Use consistent key values that will match the field values in events (404 should match status=404).
• Prefer unique keys when you expect one enrichment row per match.
• Keep the table relatively small and stable — that matches the classic User/static CSV pattern.

Example file name used in training scenarios: http_status.csv.

Step 2 — Upload the lookup table file

Typical User workflow:

1. Open Settings > Lookups > Lookup table files.
2. Choose Add new (wording can vary slightly by Splunk version/UI skin).
3. Select the Destination app (often Search & Reporting for personal/learning use, or a team app in real environments).
4. Upload the CSV and give it a clear file name.
5. Save.

After upload, the CSV exists as a lookup table file knowledge object. Uploading alone is not always enough for convenient | lookup my_definition ... usage — you normally still need a lookup definition.

Step 3 — Create the lookup definition

1. Go to Settings > Lookups > Lookup definitions.
2. Choose Add new.
3. Set the Destination app.
4. Provide a Name for the definition (for example http_status). This name is what searches and automatic lookups usually reference.
5. Set Type to a file-based / CSV lookup (exact label can read like "File-based" depending on product UI).
6. Select the lookup file you uploaded (http_status.csv).
7. Save.

Now you have a reusable definition. In searches you can run something like:

... | lookup http_status status OUTPUT status_description, status_type

(Exact OUTPUT syntax is covered in section 8.4.)

Why both file and definition exist

Splunk separates storage from configuration:

• Lookup table file = "Here is the CSV content."
• Lookup definition = "Here is the named lookup called http_status that uses that CSV, with matching/advanced options as configured."

Advanced options can exist on definitions (minimum matches, default matches, case sensitivity behavior depending on configuration). For User exam readiness, prioritize the happy path: upload CSV → create CSV/file-based definition → share appropriately → use it.

Also note: documentation states that one lookup table can have multiple lookup definitions. On the exam, you usually create one straightforward definition per uploaded practice CSV.

Permissions basics (sharing)

Lookup files and definitions are knowledge objects. After creating them, set permissions so the right people and apps can use them.

Common sharing choices (conceptual):

Read vs write matters too. Many teammates need read so they can run lookups in searches; fewer people should have write to edit the CSV or redefine matching.

Exam-ready habit: If a question says a coworker cannot see or use your lookup, check permissions/sharing and the app context before assuming the CSV upload failed.

Destination app awareness

Creating the object in the wrong app is a frequent real-world mistake. If you upload the file to App A but create the definition in App B without proper sharing, searches in App B may not find what you expect. On scenario questions, match destination app and sharing to where users actually search.

What you are not doing in this User step

Creating a User-level CSV lookup definition is not the same as:

• Building a data model
• Mapping CIM fields
• Writing macros
• Creating tags or event types
• Designing KV Store collections as an admin project

Those topics belong elsewhere (often Power User / Admin). Keep Domain 7.0 grounded in Settings > Lookups, CSV files, definitions, permissions, automatic lookups, and the | lookup command.

Checklist before moving on

• CSV has headers and a clear key column
• File uploaded under Lookup table files
• Definition created under Lookup definitions and points at that file
• Permissions allow intended users/apps to read it
• You know the definition name you will use in searches

Suggested create order (User lab style)

1. Draft http_status.csv locally with header + rows
2. Settings > Lookups > Lookup table files → upload
3. Settings > Lookups > Lookup definitions → create CSV/file-based definition named http_status
4. Set sharing so your app can read it
5. Test with a manual | lookup before creating any automatic lookup

That order prevents the common mistake of configuring automation against a definition that was never verified.