topic Re: How can I iterate through an inputlookup? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-can-I-iterate-through-an-inputlookup/m-p/411275#M118653 <P>Great @jkat54, and if the host is named differently in the <CODE>inputlookup</CODE>?</P> Fri, 25 May 2018 16:46:04 GMT ddrillic 2018-05-25T16:46:04Z How can I iterate through an inputlookup? https://community.splunk.com/t5/Splunk-Search/How-can-I-iterate-through-an-inputlookup/m-p/411273#M118651 <P>I have the following query - </P> <PRE><CODE>index=_internal host = &lt;host1&gt; OR host = &lt;host2&gt; OR host = &lt;host3&gt; | table _time host | dedup host | sort host </CODE></PRE> <P>I would like to run this commmand via a <CODE>inputlookup</CODE>. So, I created this lookup and <CODE>| inputlookup hosts_05_25_18</CODE> shows the host names.</P> <P>How can I run the above query using this <CODE>inputlookup</CODE>?</P> <P>Similar to the case at <A href="https://answers.splunk.com/answers/443165/inputlookup-how-to-search-through-all-lookup-field.html">inputlookup - How to search through all lookup fields</A></P> Fri, 25 May 2018 15:44:33 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-iterate-through-an-inputlookup/m-p/411273#M118651 ddrillic 2018-05-25T15:44:33Z Re: How can I iterate through an inputlookup? https://community.splunk.com/t5/Splunk-Search/How-can-I-iterate-through-an-inputlookup/m-p/411274#M118652 <PRE><CODE> index=yourIndex [ | inputlookup lookupname | format ] </CODE></PRE> Fri, 25 May 2018 16:17:13 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-iterate-through-an-inputlookup/m-p/411274#M118652 jkat54 2018-05-25T16:17:13Z Re: How can I iterate through an inputlookup? https://community.splunk.com/t5/Splunk-Search/How-can-I-iterate-through-an-inputlookup/m-p/411275#M118653 <P>Great @jkat54, and if the host is named differently in the <CODE>inputlookup</CODE>?</P> Fri, 25 May 2018 16:46:04 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-iterate-through-an-inputlookup/m-p/411275#M118653 ddrillic 2018-05-25T16:46:04Z Re: How can I iterate through an inputlookup? https://community.splunk.com/t5/Splunk-Search/How-can-I-iterate-through-an-inputlookup/m-p/411276#M118654 <P>Sure, try something like this</P> <PRE><CODE>| inputlookup lookupname | eval host=‘*’.fieldFromLookup.’*’ | format </CODE></PRE> <P>This would add wildcards around the field value before returning to the root search</P> Fri, 25 May 2018 18:44:19 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-iterate-through-an-inputlookup/m-p/411276#M118654 jkat54 2018-05-25T18:44:19Z Re: How can I iterate through an inputlookup? https://community.splunk.com/t5/Splunk-Search/How-can-I-iterate-through-an-inputlookup/m-p/411277#M118655 <P>For the record, <CODE>eval host=host + "*"</CODE> worked to include hosts with domain names...</P> Sun, 27 Jan 2019 22:12:21 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-iterate-through-an-inputlookup/m-p/411277#M118655 ddrillic 2019-01-27T22:12:21Z Re: How can I iterate through an inputlookup? https://community.splunk.com/t5/Splunk-Search/How-can-I-iterate-through-an-inputlookup/m-p/411278#M118656 <P>It's good to have here a reference to this masterpiece answer by @acharlieh - <A href="https://answers.splunk.com/answers/390349/what-is-the-basic-difference-between-the-lookup-in.html">What is the basic difference between the lookup, inputlook and outputlookup commands</A></P> Mon, 11 Feb 2019 01:13:28 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-iterate-through-an-inputlookup/m-p/411278#M118656 ddrillic 2019-02-11T01:13:28Z