https://community.splunk.com/t5/All-Apps-and-Add-ons/inputlookup/m-p/63214#M3871 <P>make sure you have a | at the front of your search, and that it is the first command in the search.</P> Fri, 15 Mar 2013 15:56:47 GMT alacercogitatus 2013-03-15T15:56:47Z https://community.splunk.com/t5/All-Apps-and-Add-ons/inputlookup/m-p/63210#M3867 <P>Hello,</P> <P>I know to view a csv, I can run | inputlookup asdf.csv. How would I be able to view multiple csvs in one search query?</P> Fri, 15 Mar 2013 15:16:56 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/inputlookup/m-p/63210#M3867 sd248011 2013-03-15T15:16:56Z https://community.splunk.com/t5/All-Apps-and-Add-ons/inputlookup/m-p/63211#M3868 <P>inputlookup, append, inputlookup, append, ...?</P> Fri, 15 Mar 2013 15:29:48 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/inputlookup/m-p/63211#M3868 martin_mueller 2013-03-15T15:29:48Z https://community.splunk.com/t5/All-Apps-and-Add-ons/inputlookup/m-p/63212#M3869 <P>A better solution would be:</P> <P><CODE>|inputlookup file1.csv | inputlookup file2.csv append=t|...</CODE></P> Fri, 15 Mar 2013 15:37:08 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/inputlookup/m-p/63212#M3869 alacercogitatus 2013-03-15T15:37:08Z https://community.splunk.com/t5/All-Apps-and-Add-ons/inputlookup/m-p/63213#M3870 <P>I receive this error:</P> <P>Error in 'inputlookup' command: This command must be the first command of a search.</P> Fri, 15 Mar 2013 15:55:09 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/inputlookup/m-p/63213#M3870 sd248011 2013-03-15T15:55:09Z https://community.splunk.com/t5/All-Apps-and-Add-ons/inputlookup/m-p/63214#M3871 <P>make sure you have a | at the front of your search, and that it is the first command in the search.</P> Fri, 15 Mar 2013 15:56:47 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/inputlookup/m-p/63214#M3871 alacercogitatus 2013-03-15T15:56:47Z https://community.splunk.com/t5/All-Apps-and-Add-ons/inputlookup/m-p/63215#M3872 <P>I do. It is because inputlookup is stated after the append. I can run the | inputlookup file1.csv just fine. It is the subsequent csvs I can't seem to also pull up.</P> Fri, 15 Mar 2013 16:02:45 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/inputlookup/m-p/63215#M3872 sd248011 2013-03-15T16:02:45Z https://community.splunk.com/t5/All-Apps-and-Add-ons/inputlookup/m-p/63216#M3873 <P>can you post your search that is failing?</P> Fri, 15 Mar 2013 16:04:15 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/inputlookup/m-p/63216#M3873 alacercogitatus 2013-03-15T16:04:15Z https://community.splunk.com/t5/All-Apps-and-Add-ons/inputlookup/m-p/63217#M3874 <P>|inputlookup c2_zeus.csv append=t| inputlookup DNS_Domains_malware.csv</P> Mon, 28 Sep 2020 13:31:41 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/inputlookup/m-p/63217#M3874 sd248011 2020-09-28T13:31:41Z https://community.splunk.com/t5/All-Apps-and-Add-ons/inputlookup/m-p/63218#M3875 <P>You have them backwards. Swap the two. For each inputlookup after the first, you need "append=t"</P> Fri, 15 Mar 2013 16:27:17 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/inputlookup/m-p/63218#M3875 alacercogitatus 2013-03-15T16:27:17Z https://community.splunk.com/t5/All-Apps-and-Add-ons/inputlookup/m-p/63219#M3876 <P>The c2_zeus.csv is the first. Then I have append=t after that and the second csv. My example above is exactly like how your query was stated originally. It just doesn't let you put a subsequent inputlookup command after the initial one.</P> Fri, 15 Mar 2013 16:34:59 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/inputlookup/m-p/63219#M3876 sd248011 2013-03-15T16:34:59Z https://community.splunk.com/t5/All-Apps-and-Add-ons/inputlookup/m-p/63220#M3877 <P>My initial answer had an append=t because I normally append lookups to search results. Try this: <CODE>|inputlookup c2_zeus.csv | inputlookup DNS_DOMAINS_malware.csv append=t</CODE></P> Fri, 15 Mar 2013 16:47:24 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/inputlookup/m-p/63220#M3877 alacercogitatus 2013-03-15T16:47:24Z https://community.splunk.com/t5/All-Apps-and-Add-ons/inputlookup/m-p/63221#M3878 <P>Ah, got it. Thanks much!</P> Fri, 15 Mar 2013 16:50:03 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/inputlookup/m-p/63221#M3878 sd248011 2013-03-15T16:50:03Z