topic Re: How to search values in the lookup file? in Splunk Search

How to search values in the lookup file?

prasant — Fri, 27 Jan 2023 01:44:08 GMT

I have sample.csv file with about 30000 rows with columns:

sample data

data	value1	value2
5600012345	abc	xxx
7890012345	fsfs	rwrr

I have below query

index="b2c" |rex field=path1.path2.details "code=\'(?<data>[^\n\r\']{10})"

I can see the extracted 'data' field in the fields list.
I want to query 'data' column values in the csv file and return table with the data and other fields from the event and csv file. how to use inputlookup or lookup command to search the extracted field? Thanks for the help in advance

Re: search values in the lookup file

richgalloway — Fri, 27 Jan 2023 01:32:33 GMT

What you describe is exactly what the lookup command does. You can read about it at https://docs.splunk.com/Documentation/Splunk/9.0.3/SearchReference/Lookup

index="b2c" |rex field=path1.path2.details "code=\'(?<data>[^\n\r\']{10})" | lookup sample.csv data OUTPUT value1 value2

Re: search values in the lookup file

prasant — Fri, 27 Jan 2023 03:16:44 GMT

Thanks but getting Streamed search execute failed because: Error in 'lookup' command: Could not construct lookup error,

This works though | search [ | inputlookup sample.csv | fields data]|
but how can I add the other corresponding columns from csv file along with the other fields from the event?

Re: search values in the lookup file

bowesmana — Fri, 27 Jan 2023 04:07:20 GMT

The lookup command @richgalloway gave should be correct and is definitely the right way to use a lookup.

Look at this question - it has similarities to yours

https://community.splunk.com/t5/Splunk-Search/Could-not-construct-lookup/m-p/503505

Re: How to search values in the lookup file?

prasant — Fri, 27 Jan 2023 04:50:50 GMT

Thanks..not sure why I keep getting error.. this works though | search [ | inputlookup sample.csv | fields data]|lookup sample.csv data local=true .
This returned all the other fields from csv file to the 'interesting fields' sidebar.

Re: How to search values in the lookup file?

bowesmana — Fri, 27 Jan 2023 05:15:37 GMT

FYI:

All you need to show a lookup is

| inputlookup sample.csv

prefixing it with search and putting it in a subsearch is not necessary.

but doing that operation is a different thing to doing

| lookup sample.csv data OUTPUT value1 value2