topic Re: inputlookup special fields in Splunk Search

inputlookup special fields

acadea — Thu, 24 Jun 2021 15:08:22 GMT

Hello,
I have recently found there is a strange difference between lookup and inputlookup commands.

The "mydata" lookup is a kvstore collection, with the following columns
uid, name, address, fields
I was expecting these two queries to have the same results, but no.
It seems the column "fields" is an array and it's returning a lot of data when used with the inputlookup command , which is not the case with the first (lookup) query.

The inputlookup results are like this:

I didn't find any documentation about this.
Your input is welcomed.
Thanks

Re: inputlookup special fields

richgalloway — Thu, 24 Jun 2021 14:29:59 GMT

Yes, there is a difference between lookup and inputlookup, but it's not that strange.

The lookup command searches a lookup table for the given field(s) and returns the corresponding fields for the found value. It's like getting someone's phone number from a telephone directory (remember those?) - find name, return number.

The inputlookup command returns the entire contents of the lookup file (unless the where option is used). It's the equivalent of saying "read to me the whole phone book". It has nothing to do with how the columns are named.

I hope this explains why your queries behave the way they do.

Re: inputlookup special fields

acadea — Thu, 24 Jun 2021 14:38:00 GMT

that's the definition, it's obvious they are different commands

but the results of those two commands should have been the same.

I'm still digging, it seems the "fields" it's an array

that makes me think lookup cannot deal with displaying arrays while inputlookup can show them

Re: inputlookup special fields

richgalloway — Thu, 24 Jun 2021 14:42:49 GMT

I think the difference in output comes from the join command, By default, it uses an inner join when perhaps you're expecting an outer join.

Try

|makeresults | eval uid="asdf" | join type=outer uid [| inputlookup mydata]

Re: inputlookup special fields

acadea — Thu, 24 Jun 2021 14:45:26 GMT

thank you,
I've edited/updated the initial question with an example