topic Re: what is the difference between inputcsv and inputlookup? in Knowledge Management

what is the difference between inputcsv and inputlookup?

asmithe — Tue, 01 Apr 2014 20:46:51 GMT

From the documentation it looks that the difference is mostly the file location of the input file.

Can anyone with more experience with these two search commands comment on why you might choose to use inputlookup vs. inputcsv?

Re: what is the difference between inputcsv and inputlookup?

somesoni2 — Tue, 01 Apr 2014 21:05:27 GMT

One difference I can see is that you can restrict the execution of the command/access to csv data using role security using inputlookup. (inputlookup loads data from lookup table file/lookup definition file permissions for which can be set)

Re: what is the difference between inputcsv and inputlookup?

somesoni2 — Tue, 01 Apr 2014 21:07:18 GMT

Portability of csv file can also be a factor for having a csv file added as lookup table file (under an app) so they can be deployed across various splunk instances as part of app package.

Re: what is the difference between inputcsv and inputlookup?

MuS — Wed, 02 Apr 2014 06:29:06 GMT

as addition:
inputcsv must be the first command in a search, where as a lookup can be done anywhere in the search path

Re: what is the difference between inputcsv and inputlookup?

somesoni2 — Wed, 02 Apr 2014 14:15:45 GMT

Are you sure it should be the first command, I guess we can do things like "index=_internal | inputcsv abc.csv append=t"

Re: what is the difference between inputcsv and inputlookup?

aelliott — Wed, 02 Apr 2014 15:06:35 GMT

inputcsv can be treated as "events" by setting a flag that will allow for timecharts of the data.

Re: what is the difference between inputcsv and inputlookup?

araitz — Wed, 02 Apr 2014 16:08:35 GMT

inputlookup treats the given lookup as input. If CSV files, lookups must be in $SPLUNK_HOME/etc/apps//lookups. Otherwise, they might be scripted or external_url lookups, in which case a script or URL is providing said input.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Inputlookup

inputcsv treats the given CSV file as input. CSV files can only be used if they live in $SPLUNK_HOME/var/run/splunk.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Inputcsv

Re: what is the difference between inputcsv and inputlookup?

MuS — Thu, 03 Apr 2014 06:34:38 GMT

@somesoni2: thanks for this hint! using append=t works, without you will get the must be first search command error 😉