topic Rest search with input from inputlook in Splunk Search

Rest search with input from inputlook

jariw — Wed, 24 Feb 2021 14:30:28 GMT

Hi,

I'm bouncing my head against the wall for this (probably) simple question..

I've got a inputlookup "indexers". As the name says.. those are the splunk indexers, but will be more than that in the future. I want to get disc sizes off them with the below serach

It all goes well until the map command. The stats gives a nice list off the servers. It goes wrong at the "search (| rest splunk_server=$host$ /services/server/status/partitions-space]" part.

When i try this part off the search.. it strips the | from the search.. and gives nothing. It seems a search command followed with a | will strip the | .. and then de rest search is useless.

What can i do to pass the hostnames from the inputlookup to the |rest search?

Thanx in advance

grts

Jari

Re: Rest search with input from inputlook

manjunathmeti — Wed, 24 Feb 2021 14:55:55 GMT

Hi Jari,

You don't need to run sub-search for each host. Run rest command first, append lookup results, and use stats to merge.

| where host="*" gives results only for hosts in the lookup file.

If this reply helps you, an upvote/like would be appreciated.

Re: Rest search with input from inputlook

jariw — Wed, 24 Feb 2021 15:24:13 GMT

Yes.. That's it. Didn't think about changing the order. Thanx again 👍

Re: Rest search with input from inputlook

manjunathmeti — Wed, 24 Feb 2021 15:37:45 GMT

please accept and upvote answer if it is working.