topic Re: using inputlookup command on csv file in Splunk Search

using inputlookup command on csv file

v709587 — Wed, 23 Jan 2019 07:24:33 GMT

Hi,
I am new to Splunk.
Attached screenshot is the data of my csv file. Please provide me a query to display the value of Field 3 for corresponding Field1 and Field2 values using inputlookup or lookup command.

Regards,
Vandana

Re: using inputlookup command on csv file

richgalloway — Wed, 23 Jan 2019 13:58:48 GMT

What have you tried so far? What results did you get?

Re: using inputlookup command on csv file

somesoni2 — Wed, 23 Jan 2019 19:48:07 GMT

See this on how to upload your csv file as lookup table file.
https://docs.splunk.com/Documentation/Splunk/7.2.3/Knowledge/Usefieldlookupstoaddinformationtoyourevents

Once you've the lookup table in your Splunk instance, you can use the lookup table as described here:
https://docs.splunk.com/Documentation/Splunk/7.2.3/SearchReference/Lookup

Re: using inputlookup command on csv file

ashmaind — Tue, 29 Jan 2019 07:43:01 GMT

| lookup lookup_name field1, field2 OUTPUTNEW field3

Re: using inputlookup command on csv file

v709587 — Tue, 29 Jan 2019 07:54:28 GMT

I found the answer:
|inputlookup file.csv | where Colum1="$Column1$" AND Column2="$Clomun2" | return $Column3

Re: using inputlookup command on csv file

v709587 — Tue, 29 Jan 2019 07:56:19 GMT

I found the answer:
|inputlookup file.csv | where Column1="$Column1$" AND Column2="$Column2$" | return $Column3