topic Re: Need Help with inputlookup within a search in Splunk Search

Could someone help me with inputlookup within a search?

desperate — Sun, 18 Sep 2022 23:46:54 GMT

Hi all,

I am quite new to Splunk and now trying to create a dashboard panel using a query that does the following:

pulls the required fields from an index based on textfield input
checks on one specific field "opsID" from the index against a field "code" in a csv i uploaded
if it is present in the csv, I just want to return a simple output that I could use to display in a table form

The csv looks something like this:

code, notes
123, User
456, Admin
789, User

Example of my query:

index=userdatabase "abc12345"
| eval abc=[|inputlookup Lookup.csv | where code=opsID| fields notes]
| eval isPresent=if(abc!="", YES, NO)
| table username, isPresent

However I am getting errors like Error in 'eval' command: The expression is malformed. An unexpected character is reached at ')'. I tried for a few days can't seem to figure it out my mistake, hence hoping for some help over my basic question.. I got a feeling my logic could be wrong to begin with

Re: Need Help with inputlookup within a search

scelikok — Sun, 18 Sep 2022 10:32:46 GMT

Hi @desperate,

You can try below;

index=userdatabase "abc12345" | lookup Lookup.csv code as opsID OUTPUT notes | eval isPresent=if(isnotnull(notes), "YES", "NO") | table username, isPresent

Re: Need Help with inputlookup within a search

gcusello — Sun, 18 Sep 2022 10:36:11 GMT

Hi @desperate,

you should read the documentation about lookup command at https://docs.splunk.com/Documentation/Splunk/9.0.1/SearchReference/Lookup and it could be a good idea to follow the Splunk Search Tutorial to better learn abou SPL http://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/WelcometotheSearchTutorial .

Anyway, to solve your problem, please try this:

index=userdatabase "abc12345" | lookup Lookup.csv code AS opsID OUTPUT notes | where notes=* | table code notes

Ciao.

Giuseppe

Re: Need Help with inputlookup within a search

desperate — Sun, 18 Sep 2022 11:14:45 GMT

Thank you Sir @scelikok and @gcusello .

Appreciate the help, both of you are correct. I did not think toward this direction, i was over complicating my own query.

It works now. Once again appreciate the quick response