https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-use-inputlookup-with-realtime-search/m-p/165170#M15645 <P>This worked for me. Thanks!</P> Wed, 07 Jan 2015 13:40:43 GMT jedatt01 2015-01-07T13:40:43Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-use-inputlookup-with-realtime-search/m-p/165168#M15643 <P>I want to create a search that populates a map with real-time data. But I also have data in a lookup table that I want to include using the inputlookup command. I want the data from the lookup to populate before the realtime search begins so the first points that populate on the map are from the lookup table. Does anyone know how this can be accomplished? </P> Sat, 27 Dec 2014 17:16:52 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-use-inputlookup-with-realtime-search/m-p/165168#M15643 jedatt01 2014-12-27T17:16:52Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-use-inputlookup-with-realtime-search/m-p/165169#M15644 <P>You can use <CODE>inputlookup</CODE> in a real-time search as long as you set <CODE>append=true</CODE>. Here's an example:</P> <PRE><CODE> index=* OR index=_* | stats count by index | inputlookup append=true monitored_indexes.csv | fillnull | stats max(count) as count by index </CODE></PRE> <P>Run that over a real-time window and you'll have the count of events from the search itself and the list of indexes without events filled in with <CODE>count=0</CODE> by the <CODE>inputlookup | fillnull | stats</CODE>.</P> Sun, 28 Dec 2014 01:09:40 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-use-inputlookup-with-realtime-search/m-p/165169#M15644 martin_mueller 2014-12-28T01:09:40Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-use-inputlookup-with-realtime-search/m-p/165170#M15645 <P>This worked for me. Thanks!</P> Wed, 07 Jan 2015 13:40:43 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-use-inputlookup-with-realtime-search/m-p/165170#M15645 jedatt01 2015-01-07T13:40:43Z