divious1
8.5 KiB
Lookup Manifest Schema
https://api.splunkresearch.com/schemas/lookups.json
A object that defines a lookup file and its properties.
| Abstract | Extensible | Status | Identifiable | Custom Properties | Additional Properties | Access Restrictions | Defined In |
|---|---|---|---|---|---|---|---|
| Can be instantiated | No | Unknown status | No | Forbidden | Allowed | none | lookups.spec.json |
Lookup Manifest Type
object (Lookup Manifest)
one (and only one) of
Lookup Manifest Properties
| Property | Type | Required | Nullable | Defined by |
|---|---|---|---|---|
| case_sensitive_match | string |
Optional | cannot be null | Lookup Manifest |
| collection | string |
Optional | cannot be null | Lookup Manifest |
| default_match | string |
Optional | cannot be null | Lookup Manifest |
| description | string |
Optional | cannot be null | Lookup Manifest |
| fields_list | string |
Optional | cannot be null | Lookup Manifest |
| filename | string |
Optional | cannot be null | Lookup Manifest |
| filter | string |
Optional | cannot be null | Lookup Manifest |
| match_type | string |
Optional | cannot be null | Lookup Manifest |
| max_matches | integer |
Optional | cannot be null | Lookup Manifest |
| min_matches | integer |
Optional | cannot be null | Lookup Manifest |
| name | string |
Optional | cannot be null | Lookup Manifest |
case_sensitive_match
What the macro is intended to filter
case_sensitive_match
-
is optional
-
Type:
string -
cannot be null
-
defined in: Lookup Manifest
case_sensitive_match Type
string
case_sensitive_match Constraints
enum: the value of this property must be equal to one of the following values:
| Value | Explanation |
|---|---|
"true" |
|
"false" |
case_sensitive_match Examples
'true'
collection
Name of the collection to use for this lookup
collection
-
is optional
-
Type:
string -
cannot be null
-
defined in: Lookup Manifest
collection Type
string
collection Examples
prohibited_apps_launching_cmd
default_match
The default value if no match is found
default_match
-
is optional
-
Type:
string -
cannot be null
-
defined in: Lookup Manifest
default_match Type
string
default_match Examples
'true'
description
The description of this lookup
description
-
is optional
-
Type:
string -
cannot be null
-
defined in: Lookup Manifest
description Type
string
description Examples
This lookup contains file names that exist in the Windows\System32 directory
fields_list
A comma and space separated list of field names
fields_list
-
is optional
-
Type:
string -
cannot be null
-
defined in: Lookup Manifest
fields_list Type
string
fields_list Examples
_key, dest, process_name
filename
The name of the file to use for this lookup
filename
-
is optional
-
Type:
string -
cannot be null
-
defined in: Lookup Manifest
filename Type
string
filename Examples
prohibited_apps_launching_cmd.csv
filter
Use this attribute to improve search performance when working with significantly large KV
filter
-
is optional
-
Type:
string -
cannot be null
-
defined in: Lookup Manifest
filter Type
string
filter Examples
dest="SPLK_*"
match_type
A comma and space-delimited list of <match_type>(<field_name>) specification to allow for non-exact matching
match_type
-
is optional
-
Type:
string -
cannot be null
-
defined in: Lookup Manifest
match_type Type
string
match_type Examples
WILDCARD(process)
max_matches
The maximum number of possible matches for each input lookup value
max_matches
-
is optional
-
Type:
integer -
cannot be null
-
defined in: Lookup Manifest
max_matches Type
integer
max_matches Examples
'100'
min_matches
Minimum number of possible matches for each input lookup value
min_matches
-
is optional
-
Type:
integer -
cannot be null
-
defined in: Lookup Manifest
min_matches Type
integer
min_matches Examples
'1'
name
The name of the lookup to be used in searches
name
-
is optional
-
Type:
string -
cannot be null
-
defined in: Lookup Manifest
name Type
string
name Examples
isWindowsSystemFile_lookup