https://community.splunk.com/t5/Splunk-Search/inputlookup-with-database-lookup/m-p/58816#M14438 <P>Is there a way to use a database lookup in the way you would using inputlookup? If I wanted to just dump the contents to be searched against? I can do it with dbquery but wonder if there is a way to do this with inputlookup or lookup? I believe inputlookup only work with files (possibly an enhancement?).</P><P><BR /> This works for file based lookup, would like similar mechanism for database lookup(using dbconnect)<BR /> <CODE><BR /> | inputlookup LOOKUPDBTABLE | search BAR_CODE="123*" <BR /> </CODE><BR /> Below does not work.<BR /> <CODE><BR /> | stats count | eval BAR_CODE="123*" | lookup LOOKUPDBTABLE BAR_CODE<BR /> </CODE><BR /> Thanks,<BR /> Bob</P> Tue, 10 Sep 2013 14:20:24 GMT rdownie 2013-09-10T14:20:24Z https://community.splunk.com/t5/Splunk-Search/inputlookup-with-database-lookup/m-p/58816#M14438 <P>Is there a way to use a database lookup in the way you would using inputlookup? If I wanted to just dump the contents to be searched against? I can do it with dbquery but wonder if there is a way to do this with inputlookup or lookup? I believe inputlookup only work with files (possibly an enhancement?).</P><P><BR /> This works for file based lookup, would like similar mechanism for database lookup(using dbconnect)<BR /> <CODE><BR /> | inputlookup LOOKUPDBTABLE | search BAR_CODE="123*" <BR /> </CODE><BR /> Below does not work.<BR /> <CODE><BR /> | stats count | eval BAR_CODE="123*" | lookup LOOKUPDBTABLE BAR_CODE<BR /> </CODE><BR /> Thanks,<BR /> Bob</P> Tue, 10 Sep 2013 14:20:24 GMT https://community.splunk.com/t5/Splunk-Search/inputlookup-with-database-lookup/m-p/58816#M14438 rdownie 2013-09-10T14:20:24Z https://community.splunk.com/t5/Splunk-Search/inputlookup-with-database-lookup/m-p/58817#M14439 <P>Hi, does this work for you? <A href="http://docs.splunk.com/Documentation/DBX/1.0.11/DeployDBX/Setupadatabaselookuptable">http://docs.splunk.com/Documentation/DBX/1.0.11/DeployDBX/Setupadatabaselookuptable</A></P> Tue, 10 Sep 2013 20:58:03 GMT https://community.splunk.com/t5/Splunk-Search/inputlookup-with-database-lookup/m-p/58817#M14439 jcoates_splunk 2013-09-10T20:58:03Z