topic Re: How to dynamically append the content of multiple lookup files? in Splunk Search

How to dynamically append the content of multiple lookup files?

D2SI — Wed, 30 Sep 2020 00:09:31 GMT

Hello there,

I am trying to dynamically append the content of multiple lookup files but I am not sure it is possible.

Here how I do for now:

| inputlookup geo_attr_countries.csv
| inputlookup append=true geo_attr_us_states.csv

It is working fine but I was wondering if I could build that search without having to explicitly list lookup files.

I can build a search to retrieve the lookups:

| rest /servicesNS/-/search/data/lookup-table-files splunk_server="local"
| search title="geo_attr*.csv"
| fields title

geo_attr_countries.csv
geo_attr_us_states.csv

But I do not see how I can use this to build the search.

I was thinking of something like:

| rest /servicesNS/-/search/data/lookup-table-files splunk_server="local"
| search title="geo_attr*.csv"
| fields title
| foreach title [| inputlookup append=true <<FIELD>>]

But I would get this error:

Error in 'foreach' command: Search pipeline may not contain non-streaming commands.

So I am stuck, any idea on how to achieve this?

Thanks in advance

Re: How to dynamically append the content of multiple lookup files?

MikeElliott — Sun, 14 Apr 2019 00:40:51 GMT

Have you tried the same with | outputlookup append=true <> ?

Re: How to dynamically append the content of multiple lookup files?

HiroshiSatoh — Sun, 14 Apr 2019 03:15:33 GMT

You can do this using the map function.

| rest /servicesNS/-/search/data/lookup-table-files splunk_server="local"
| search title="geo_attr*.csv"
| map search="|inputlookup $title$"

Re: How to dynamically append the content of multiple lookup files?

D2SI — Sun, 14 Apr 2019 05:39:22 GMT

Damn, I did not know about this command, does it perfectly well!

Thanks a lot!

Re: How to dynamically append the content of multiple lookup files?

swetvenk — Wed, 30 Sep 2020 03:47:07 GMT

Hi Folks..

I have a similar requirement wherein I want the name of the lookup file to be print against the data from each of them in the following way. For some reason, the eval function is not giving the desired output. Can anyone help ?

This is giving me the correct count, but not the lookupname!

Re: How to dynamically append the content of multiple lookup files?

D2SI — Tue, 04 Feb 2020 11:47:49 GMT

Hi @swetvenk, I would do something like this :

| rest /servicesNS/-/search/data/lookup-table-files splunk_server="local" 
| search title="geo_attr*.csv" 
| map search="| makeresults | eval lkpnm=$title$ | append [| inputlookup $title$]| eventstats last(lkpnm) as lkpnm | search NOT _time="*""
| stats count by lkpnm