topic Re: Help on inputlookup subsearch in Getting Data In

Help on inputlookup subsearch

jip31 — Wed, 06 Sep 2023 13:31:27 GMT

I cross the results of a subsearch with a main search like this

index=toto [inputlookup test.csv

|eval user=Domain."\\"Sam

|table user]

|table _time user

Imagine I need to add a new lookup in my search

For example i would try to do something like this

index=toto [inputlookup test.csv OR inputlookup test2.csv

|eval user=Domain."\\"Sam

|table user]

|table _time user

How to do this please?

gcusello — Wed, 06 Sep 2023 14:24:32 GMT

you have to set the OR condition before the subsearch, something like this:

Ciao.

Giuseppe

bowesmana — Wed, 06 Sep 2023 22:43:02 GMT

Try this by combining the two lookups using append for the second lookup

I believe there is a missing '.' in your eval statement setting up user and 'Sam' is a field name?

gcusello — Thu, 07 Sep 2023 10:49:06 GMT

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

bowesmana — Mon, 27 May 2024 00:36:35 GMT

Just pointing out here that the statement

| inputlookup test.csv OR inputlookup test2.csv

is not valid Splunk - you cannot do two inputlookup commands like that.