https://community.splunk.com/t5/Splunk-Dev/Splunk-search-with-PowerShell-SDK-using-inputlooup/m-p/196639#M2647 <P>I'm trying to use the PowerShell Splunk SDK to gather information that we have saved in a lookup file. When I attempt to search with <CODE>Search-Splunk -Search "| inputlookup file.csv"</CODE> I receive the following error message: Error in 'inputlookup' command: This command must be the first command of a search. Also, Unexpected XML declaration. </P> <P>The search in double quotes works fine from the web interface, but fails when using the PowerShell SDK. Is this an issue with how the REST API handles searches? Has anyone come across this before or know of any solutions? Thank you.</P> Thu, 20 Mar 2014 15:26:30 GMT kraber 2014-03-20T15:26:30Z https://community.splunk.com/t5/Splunk-Dev/Splunk-search-with-PowerShell-SDK-using-inputlooup/m-p/196639#M2647 <P>I'm trying to use the PowerShell Splunk SDK to gather information that we have saved in a lookup file. When I attempt to search with <CODE>Search-Splunk -Search "| inputlookup file.csv"</CODE> I receive the following error message: Error in 'inputlookup' command: This command must be the first command of a search. Also, Unexpected XML declaration. </P> <P>The search in double quotes works fine from the web interface, but fails when using the PowerShell SDK. Is this an issue with how the REST API handles searches? Has anyone come across this before or know of any solutions? Thank you.</P> Thu, 20 Mar 2014 15:26:30 GMT https://community.splunk.com/t5/Splunk-Dev/Splunk-search-with-PowerShell-SDK-using-inputlooup/m-p/196639#M2647 kraber 2014-03-20T15:26:30Z https://community.splunk.com/t5/Splunk-Dev/Splunk-search-with-PowerShell-SDK-using-inputlooup/m-p/196640#M2648 <P>I haven't tried that myself, but isn't it just telling you to leave off the "|" or to make it "search|" ?? I think the rest endpoint needs you to be explicit about search, where the web UI implies it.</P> Fri, 21 Mar 2014 17:49:16 GMT https://community.splunk.com/t5/Splunk-Dev/Splunk-search-with-PowerShell-SDK-using-inputlooup/m-p/196640#M2648 jbennett_splunk 2014-03-21T17:49:16Z https://community.splunk.com/t5/Splunk-Dev/Splunk-search-with-PowerShell-SDK-using-inputlooup/m-p/196641#M2649 <P>Leaving off the pipe returns no results. Adding "Search |" throws the same error text as just having the pipe. I dug through the Search-Splunk command, it prepends/adds the implied search when in invokes the REST API. I also tried using the REST API with the format of how Search-Splunk is coded with no success.</P> Fri, 21 Mar 2014 17:56:35 GMT https://community.splunk.com/t5/Splunk-Dev/Splunk-search-with-PowerShell-SDK-using-inputlooup/m-p/196641#M2649 kraber 2014-03-21T17:56:35Z https://community.splunk.com/t5/Splunk-Dev/Splunk-search-with-PowerShell-SDK-using-inputlooup/m-p/196642#M2650 <P>Does a simple keyword search work?</P> Fri, 21 Mar 2014 18:15:00 GMT https://community.splunk.com/t5/Splunk-Dev/Splunk-search-with-PowerShell-SDK-using-inputlooup/m-p/196642#M2650 halr9000 2014-03-21T18:15:00Z https://community.splunk.com/t5/Splunk-Dev/Splunk-search-with-PowerShell-SDK-using-inputlooup/m-p/196643#M2651 <P>Ok, I change my answer to ... the opposite of what I said the first time. The problem is that the cmdlet is ADDING the "Search" ...</P> Fri, 21 Mar 2014 18:20:45 GMT https://community.splunk.com/t5/Splunk-Dev/Splunk-search-with-PowerShell-SDK-using-inputlooup/m-p/196643#M2651 jbennett_splunk 2014-03-21T18:20:45Z https://community.splunk.com/t5/Splunk-Dev/Splunk-search-with-PowerShell-SDK-using-inputlooup/m-p/196644#M2652 <P>A simple keyword search did work and returned results. I attempted to use their REST implementation and left out the "search" No dice.</P> Tue, 25 Mar 2014 11:44:41 GMT https://community.splunk.com/t5/Splunk-Dev/Splunk-search-with-PowerShell-SDK-using-inputlooup/m-p/196644#M2652 kraber 2014-03-25T11:44:41Z https://community.splunk.com/t5/Splunk-Dev/Splunk-search-with-PowerShell-SDK-using-inputlooup/m-p/196645#M2653 <P>Ran into this today too. I added a search to a non-existent index to the beginning and changed the inputlookup to append:</P> <P>index=fakeindex | inputlookup append=t file.csv</P> Thu, 24 Sep 2015 13:20:20 GMT https://community.splunk.com/t5/Splunk-Dev/Splunk-search-with-PowerShell-SDK-using-inputlooup/m-p/196645#M2653 jmccord 2015-09-24T13:20:20Z