topic Re: help with inputlookup and a subsearch in Knowledge Management

help with inputlookup and a subsearch

jip31 — Tue, 09 Apr 2019 13:42:19 GMT

hello

In the search below I try to match host in "host.csv" with host which comes from a subsearch

| inputlookup host.csv 
| table host 
| join type=left host 
    [ search index=master-data-lookups sourcetype="view_splunk_assets" 
    | stats count by HOSTNAME TOWN COUNTRY
    | fields - count 
    | rename HOSTNAME as host]

what is the problem because I have results when i execute | inputlookup host.csv OR index=master-data-lookups sourcetype="view_splunk_assets" | stats count by HOSTNAME TOWN COUNTRY | fields - count | rename HOSTNAME as host

thanks

Re: help with inputlookup and a subsearch

grittonc — Tue, 09 Apr 2019 14:21:51 GMT

What do you get when you run this entire search? Do you get records from your lookup table and nothing from the index?

Re: help with inputlookup and a subsearch

woodcock — Tue, 09 Apr 2019 14:31:11 GMT

Try this:

index=master-data-lookups sourcetype="view_splunk_assets" 
| stats count by HOSTNAME TOWN COUNTRY
| fields - count 
| rename HOSTNAME as host
| appendpipe [|inputlookup host.csv 
| table host
| eval sourcetype="csv"]
| stats values(*) AS * BY host
| search sourcetype="csv"

Re: help with inputlookup and a subsearch

grittonc — Tue, 09 Apr 2019 15:07:39 GMT

What is the significance to putting the index search first?

Re: help with inputlookup and a subsearch

HiroshiSatoh — Tue, 09 Apr 2019 15:39:13 GMT

In your search statement, "host.csv" is 1 and ”subsearch” is the first one.
If you want "host.csv" to connect multiple ”subsearch” to 1 change the max value.

host.csv
A
B
C

”subsearch”
A TOWN1 COUNTRY1
A TOWN2 COUNTRY2
C TOWN3 COUNTRY3
C TOWN4 COUNTRY4

your search results
A TOWN1 COUNTRY1
B
C TOWN3 COUNTRY3

What do you want to do?

max
Syntax: max=
Description: Specifies the maximum number of subsearch results that each main search result can join with. If set to max=0, there is no limit.
Default: 1

Re: help with inputlookup and a subsearch

jip31 — Wed, 10 Apr 2019 04:47:39 GMT

thanks a lot

Re: help with inputlookup and a subsearch

woodcock — Thu, 11 Apr 2019 01:36:50 GMT

Because the appendpipe [|inputlookup ...] trick that I invented somehow bypasses the subsearch limits, but the normal search will not.