topic Re: use inputlookup to get data in Splunk Search

use inputlookup to get data

sarit_s — Mon, 08 Jun 2020 18:13:33 GMT

Hello
I'm running this query:

index=prod eventtype="csm-messages-dhcpd-lpf-eth0-listening" OR eventtype="csm-messages-dhcpd-lpf-eth0-sending" OR eventtype="csm-messages-dhcpd-send-socket-fallback-net" OR eventtype="csm-messages-dhcpd-write-zero-leases" OR eventtype="csm-messages-dhcpd-eth1-nosubnet-declared"
| transaction maxpause=2s maxspan=1s maxevents=5
| eval max_time=(duration + _time)
| eval min_time=(_time)
| rename kafka_uuid as uuids
| where eventcount!=5
| table  eventtype ,min_time, max_time,tail_id,uuids
| eval eventtype="csm_dhcp_anomaly"

now i have csv file and i want to read the "eventtype" parameters from there. how can i call inputlookup ?
all of my tries didn't work..

thanks

Re: use inputlookup to get data

493669 — Mon, 01 Jun 2020 08:41:07 GMT

Use lookup command like-

...|lookup  <yourlookup name> <fields using you are joining> <output field names>

ref-https://docs.splunk.com/Documentation/Splunk/8.0.4/SearchReference/Lookup

Re: use inputlookup to get data

sarit_s — Mon, 01 Jun 2020 09:59:25 GMT

thanks
is it possible to group all the fields to one ?
for example, in this query i have 5 different eventtypes. if im running "|table eventtype" im getting all the 5.. if im running it from the lookup file i have each eventtype in different parameter.
is it possible to group them all ?