topic How can I use a search result as a filename variable of a inputlookup statement in Splunk Search

How can I use a search result as a filename variable of a inputlookup statement

apietersen — Tue, 29 Sep 2020 20:27:59 GMT

Hi,

I like to setup a kind of help-text library based on unique msgcode-xx.csv text files. (or internal/external tml pages/files)

With the code beneath I try to look for a filename in EVENTLIST_3v3 that I can use as an input for an appended inputlookup statement. Lookup goes ok, but I can not get it passed further as a filename argument for the next inputlookup statement.
Nb. the filename is stored in the EVENTLIST_3v3 .

What ever I tried nothing works sofar and I do not understand why a correct filename string can not be processed as parameter of a following (append,join etc) inputlookup command.

What do I miss here? Has some one have a clue?
Has some one have a better approach for this help-library functions (ie linking to html pages?)

regards
Ashley Pietersen

Re: How can I use a search result as a filename variable of a inputlookup statement

jkat54 — Thu, 19 Jul 2018 11:51:53 GMT

I do it like this on a dashboard:

| lookup 
[ 
 | makeresults count=1 
 | eval env="$VARIABLE_FROM_DROPDOWN$"
 | eval lookupname=case
 (
  match(env,"prod.*"), "prod",
  match(env,"uat.*"), "uat",
  match(env,"qa.*"), "qa"
 ) 
 | fields lookupname 
 | return $lookupname 
] fieldInLookup AS fieldInData OUTPUTNEW fieldsFromLookup

So to adapt it for your use case i think this would work:

|inputlookup
[
| makeresults 
| eval msgtxt="46 - No intervention needed" , msgcode=substr(msgtxt,0,2) 
| table msgcode
| lookup EVENTLIST_3v3 nr as msgcode OUTPUT helpdoc
| fields helpdoc
| return $helpdoc
] | table *

Re: How can I use a search result as a filename variable of a inputlookup statement

apietersen — Fri, 20 Jul 2018 07:06:44 GMT

Hi jkat54,

Thanks for the code, that was very helpful. this works fine for what I am trying to achieve,.

I will need to look in to the details about your using "return $helpdoc" and the fact that you start with inputlookup which is the other way around as I did. Thanks again!!

My final code is now:

|inputlookup
     [
     | makeresults 
     | eval msgtxt="$nr$" , msgcode=substr(msgtxt,5,2) 
     | table msgcode
     | lookup EVENTLIST_3v3 nr as msgcode OUTPUT helpdoc
     | fields helpdoc
     | return $helpdoc
     ] | table help

best regards Ashley Pietersen

Re: How can I use a search result as a filename variable of a inputlookup statement

jkat54 — Fri, 20 Jul 2018 10:57:03 GMT

Glad to help.

The return and format commands are essential when using subsearches.

Use this command reference for more details on those two commands:

http://docs.splunk.com/Documentation/Splunk/7.1.2/SearchReference/ListOfSearchCommands