topic Re: How to query a lookup table using the REST API in Splunk Search

How to query a lookup table using the REST API?

raduand — Fri, 25 Mar 2022 13:48:56 GMT

Hi guys,

I have a Splunk scheduled search which is producing a list of URLs that need to be used by another system. The other system has to access the list using http/https protocol.

Now, what i'm looking for is:

making the search results (csv file) available through something like https://splunkserver/list.csv
appending the search results to a lookup table and querying the lookup table using something like https://splunkserver:8089/servicesNS/admin/search/data/lookup-table-files/list.csv

Can someone guide me in how to achieve this?

Thanks in advance!
Andrei

Re: How to query a lookup table using the REST API

niketn — Tue, 12 Sep 2017 15:28:03 GMT

@raduand, Splunk search results can be pushed to lookup file using outputlookup. (Refer to documentation: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Outputlookup)

Within Splunk you can read csv file using inpulookup command. ( Refer to documentation: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/inputlookup)

You can create report with inputlookup command to list the contents of the csv file and the pull the Report results using REST API search/jobs/{search_id}/results. Refer to documentation: http://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTsearch#search.2Fjobs.2F.7Bsearch_id.7D.2Fresults

Re: How to query a lookup table using the REST API

jkat54 — Tue, 12 Sep 2017 17:49:11 GMT

 search="| inputlookup lookupname.csv"

Re: How to query a lookup table using the REST API

rhirasin — Thu, 17 Dec 2020 08:10:35 GMT

Thanks lot @niketn ,

you solution work perfectly,

we really miss you... 😞

Re: How to query a lookup table using the REST API

hettervik — Fri, 25 Mar 2022 11:44:36 GMT

This is great, but is there any way of finding the "search_id" of a scheduled search? I've tried using the search_id that is listed in the URL when opening the search in the GUI and the search_is that is listed on the enpoint https://<host>:<mPort>/services/search/jobs (which I found to be not the same for some reason), but I always get the result "Unknown endpoint".

Anyone know how to find the correct ID for a scheduled search?