https://community.splunk.com/t5/Splunk-Search/Are-Lookups-appropriate-here/m-p/62974#M15542 <P>hmmm... i must be doing something wrong. I'm not sure it's accessing Brands.csv should a simple search of inputlookup Brands.csv return something?</P> Thu, 13 Dec 2012 20:09:57 GMT marquiselee 2012-12-13T20:09:57Z https://community.splunk.com/t5/Splunk-Search/Are-Lookups-appropriate-here/m-p/62972#M15540 <P>I work with a bunch of media companies and on monthly basis licensing for the content they provide changes. So this week I may have rights to display the BRANDS 'NBC' 'HBO' and 'CNN' video content on mobile devices but next week that list may look like 'CBS' NBC' 'AMC' and 'ABC'.</P> <P>Right now I have many searches that look like this but with nearly 100 brands... </P> <P>search AND (BRAND="HBO" OR BRAND="CBS" OR BRAND="SHOWTIME") | Table ...</P> <P>Obviously I'd rather not change each search every time licensing agreements change. I've created a csv listing each of the Brands I have licensing for and added it as a lookup table. that looks like this.</P> <P>TYPE, VALUE<BR /> Brand,HBO <BR /> Brand,CBS<BR /> Brand,SHOWTIME<BR /> Brand,NBC<BR /> etc...</P> <P>Is this a proper use for lookups and how do I implement this in my searches?</P> Thu, 13 Dec 2012 18:53:12 GMT https://community.splunk.com/t5/Splunk-Search/Are-Lookups-appropriate-here/m-p/62972#M15540 marquiselee 2012-12-13T18:53:12Z https://community.splunk.com/t5/Splunk-Search/Are-Lookups-appropriate-here/m-p/62973#M15541 <P>If you place that csv file in the <CODE>$APP_HOME/lookups</CODE> (as Brands.csv), you can then combine that with this:</P> <P><CODE>search [ |inputlookup Brands.csv|rename VALUE as Brand|table Brand|format "(" "" "" "" "OR" ")" ]| Table...</CODE></P> Thu, 13 Dec 2012 19:12:18 GMT https://community.splunk.com/t5/Splunk-Search/Are-Lookups-appropriate-here/m-p/62973#M15541 alacercogitatus 2012-12-13T19:12:18Z https://community.splunk.com/t5/Splunk-Search/Are-Lookups-appropriate-here/m-p/62974#M15542 <P>hmmm... i must be doing something wrong. I'm not sure it's accessing Brands.csv should a simple search of inputlookup Brands.csv return something?</P> Thu, 13 Dec 2012 20:09:57 GMT https://community.splunk.com/t5/Splunk-Search/Are-Lookups-appropriate-here/m-p/62974#M15542 marquiselee 2012-12-13T20:09:57Z https://community.splunk.com/t5/Splunk-Search/Are-Lookups-appropriate-here/m-p/62975#M15543 <P>This should return the contents of your CSV: <CODE>|inputlookup Brands.csv|rename VALUE as Brand|table Brand|format "(" "" "" "" "OR" ")"</CODE>.</P> Thu, 13 Dec 2012 20:12:41 GMT https://community.splunk.com/t5/Splunk-Search/Are-Lookups-appropriate-here/m-p/62975#M15543 alacercogitatus 2012-12-13T20:12:41Z https://community.splunk.com/t5/Splunk-Search/Are-Lookups-appropriate-here/m-p/62976#M15544 <P>thanks much! I got it working eventually... I had to reformat my csv and remove the 'table Brand' from the subsearch. woot!</P> Fri, 14 Dec 2012 00:21:34 GMT https://community.splunk.com/t5/Splunk-Search/Are-Lookups-appropriate-here/m-p/62976#M15544 marquiselee 2012-12-14T00:21:34Z