topic Re: inputlookup csv in Splunk Search

inputlookup csv

keyu921 — Fri, 05 Jun 2020 21:54:44 GMT

I setup testing.csv lookup as following
host,location
123,HK
234,US
345,UK

I would like to basic search if host matched in the log, stats count by location
index=log sourcetype=csv |search [|inputlookup testing | return $host]
| stats .... by location

But seems return nothings

Re: inputlookup csv

gcusello — Mon, 25 May 2020 08:57:11 GMT

Hi @keyu921,
the command to use is lookup, try something like this:

index=log sourcetype=csv 
| lookup testing.csv host OUTPUT location
| stats count by location

Remember to define Lookup definitions.

Ciao.
Giuseppe

Re: inputlookup csv

keyu921 — Mon, 25 May 2020 08:57:42 GMT

index=* sourcetype=csv |search [|inputlookup testing| return 1000 $host]
| stats last(Size) last(Used) last(Use) by host

Re: inputlookup csv

keyu921 — Tue, 26 May 2020 02:52:37 GMT

thanks seems i mix up inputlookup and lookup