topic Re: How to pass the value in main query from the lookup file in a list of servers? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-pass-the-value-in-main-query-from-the-lookup-file-in-a/m-p/432279#M123517 <P>can you share sample values of lookup </P> <PRE><CODE>|inputlookup production_sites </CODE></PRE> <P>check if this above query gives output</P> <PRE><CODE>|inputlookup production_sites where Type="Data"|fields Type </CODE></PRE> <P>this query only give Type="data" as field I don't hink if thats you are looking for<BR /> as fields command limits the output to show only specific fields in this case as <CODE>Type</CODE></P> Tue, 28 Aug 2018 10:47:14 GMT 493669 2018-08-28T10:47:14Z How to pass the value in main query from the lookup file in a list of servers? https://community.splunk.com/t5/Splunk-Search/How-to-pass-the-value-in-main-query-from-the-lookup-file-in-a/m-p/432272#M123510 <P>I have a list of server in lookup file and I want to create an alert.<BR /> The list of server names in the lookup file(around 90 servers) and I need to pass the value in the main query from the lookup file.</P> <P>The column server has a value with around 90servers so I need to pass the 90 servers values in the search.</P> Tue, 28 Aug 2018 07:17:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-pass-the-value-in-main-query-from-the-lookup-file-in-a/m-p/432272#M123510 DataOrg 2018-08-28T07:17:30Z Re: How to pass the value in main query from the lookup file in a list of servers? https://community.splunk.com/t5/Splunk-Search/How-to-pass-the-value-in-main-query-from-the-lookup-file-in-a/m-p/432273#M123511 <P>index=foo [| inputlookup yourlookup.csv OUTPUTNEW hostFieldFromLookup AS host | fields host | format host]</P> <P>Which will turn into</P> <P>index=foo (host=hostname1 OR host=hostname2 OR ...)</P> Tue, 28 Aug 2018 07:22:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-pass-the-value-in-main-query-from-the-lookup-file-in-a/m-p/432273#M123511 jkat54 2018-08-28T07:22:50Z Re: How to pass the value in main query from the lookup file in a list of servers? https://community.splunk.com/t5/Splunk-Search/How-to-pass-the-value-in-main-query-from-the-lookup-file-in-a/m-p/432274#M123512 <P>if lookup file is already created in splunk then use</P> <PRE><CODE>...|inputlookup &lt;filename&gt; </CODE></PRE> Tue, 28 Aug 2018 07:23:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-pass-the-value-in-main-query-from-the-lookup-file-in-a/m-p/432274#M123512 493669 2018-08-28T07:23:05Z Re: How to pass the value in main query from the lookup file in a list of servers? https://community.splunk.com/t5/Splunk-Search/How-to-pass-the-value-in-main-query-from-the-lookup-file-in-a/m-p/432275#M123513 <P>i need to get a data from lookup file and have to pass it in same query of the sub search</P> Tue, 28 Aug 2018 07:32:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-pass-the-value-in-main-query-from-the-lookup-file-in-a/m-p/432275#M123513 DataOrg 2018-08-28T07:32:40Z Re: How to pass the value in main query from the lookup file in a list of servers? https://community.splunk.com/t5/Splunk-Search/How-to-pass-the-value-in-main-query-from-the-lookup-file-in-a/m-p/432276#M123514 <P>it will not work.</P> <P>i need to read the lookup file and pass the value to sub-search</P> Tue, 28 Aug 2018 07:35:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-pass-the-value-in-main-query-from-the-lookup-file-in-a/m-p/432276#M123514 DataOrg 2018-08-28T07:35:48Z Re: How to pass the value in main query from the lookup file in a list of servers? https://community.splunk.com/t5/Splunk-Search/How-to-pass-the-value-in-main-query-from-the-lookup-file-in-a/m-p/432277#M123515 <P>have you created lookup file in splunk? what is the name of lookup file? </P> Tue, 28 Aug 2018 07:54:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-pass-the-value-in-main-query-from-the-lookup-file-in-a/m-p/432277#M123515 493669 2018-08-28T07:54:54Z Re: How to pass the value in main query from the lookup file in a list of servers? https://community.splunk.com/t5/Splunk-Search/How-to-pass-the-value-in-main-query-from-the-lookup-file-in-a/m-p/432278#M123516 <P>i am using below search</P> <P>|inputlookup production_sites where Type="Data"|fields Type|format|table search|mvexpand search | stats count by search|rename search as R|map search="search index="perfmo" host=\"$R$\" source="Perfmon" sourcetype="Physical_Disk" counter="sec/Read" (instance="*G:" OR instance="*J:")"</P> Tue, 29 Sep 2020 21:04:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-pass-the-value-in-main-query-from-the-lookup-file-in-a/m-p/432278#M123516 DataOrg 2020-09-29T21:04:11Z Re: How to pass the value in main query from the lookup file in a list of servers? https://community.splunk.com/t5/Splunk-Search/How-to-pass-the-value-in-main-query-from-the-lookup-file-in-a/m-p/432279#M123517 <P>can you share sample values of lookup </P> <PRE><CODE>|inputlookup production_sites </CODE></PRE> <P>check if this above query gives output</P> <PRE><CODE>|inputlookup production_sites where Type="Data"|fields Type </CODE></PRE> <P>this query only give Type="data" as field I don't hink if thats you are looking for<BR /> as fields command limits the output to show only specific fields in this case as <CODE>Type</CODE></P> Tue, 28 Aug 2018 10:47:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-pass-the-value-in-main-query-from-the-lookup-file-in-a/m-p/432279#M123517 493669 2018-08-28T10:47:14Z