topic Re: Search all lookup files in Splunk Search

Is there a way to search across multiple lookup files to find text within them?

finchy — Fri, 27 Jan 2023 22:30:10 GMT

Is there a way to search across multiple Lookup files to find text within them ? I know that you can use | inputlookup to get the contents of a single lookup csv file but I'm trying to search for any csv files that might have a specific string value.

Re: Search all lookup files

richgalloway — Fri, 27 Jan 2023 13:57:04 GMT

Searching multiple lookup files requires using multiple lookup commands, one for each file.

Re: Search all lookup files

scelikok — Fri, 27 Jan 2023 13:58:42 GMT

@finchy,

You can use below sample, it will search for "text_to_search" value in all lookups. It is better to limit lookup files by filtering title.

| rest /servicesNS/-/-/data/lookup-table-files f=title | fields title | dedup title | map maxsearches=1000 search="|inputlookup $title$ | fieldsummary |eval lookup_name=$title$ | fields values field lookup_name " | spath input=values | rename {}.* as *| fields lookup_name field value | search value="text_to_search"

Re: Search all lookup files

finchy — Fri, 27 Jan 2023 14:36:30 GMT

Hi,

Thanks i get this error message and only returns a few records guess i don't have enough permissions

Restricting results of the "rest" operator to the local instance because you do not have the "dispatch_rest_to_indexers" capability

Re: Search all lookup files

richgalloway — Fri, 27 Jan 2023 14:43:08 GMT

There's no need to grab lookup files from the indexers since the SH should have the same ones. Use the splunk_server=local option to suppress the warning.

| rest splunk_server=local /servicesNS/-/-/data/lookup-table-files f=title | fields title | dedup title | map maxsearches=1000 search="|inputlookup $title$ | fieldsummary |eval lookup_name=$title$ | fields values field lookup_name " | spath input=values | rename {}.* as *| fields lookup_name field value | search value="text_to_search"