topic Re: How to extract filename from inputlookup csv file with query in Splunk Search

How to extract filename from inputlookup csv file with query

bimatomsoc — Wed, 29 Nov 2023 08:26:12 GMT

I want to get my inputlookup csv filename with the query.

| inputlookup abc.csv
| stats count by inputlookup_filename ```<= the result I needed is "abc"```
Or
| table inputlookup_filename ```<= the result I needed is "abc"```

Re: How to extract filename from inputlookup csv file with query

isoutamo — Wed, 29 Nov 2023 08:40:06 GMT

you get filename with rest e.g.

| rest /services/data/lookup-table-files search="abc.csv" | fields title eai:appName eai:data

r. Ismo

Re: How to extract filename from inputlookup csv file with query

bimatomsoc — Wed, 29 Nov 2023 11:09:55 GMT

Thanks for your response. It's really helpful and knowledgeable. Your rest query can get the lookupfilename as title.

Actually, my original search query is -

When I put rest query that you provided, "rest" must be the first place in search.
I do want to know how to combine my original query and rest query to get the new_field and lookupfilename.

Re: How to extract filename from inputlookup csv file with query

isoutamo — Wed, 29 Nov 2023 10:35:46 GMT

Can you describe what and why you want? Currently I haven’t any hints how and where you would like to get it 😞
Usually you could should use sub query to add it, but we should know what you are looking.

Re: How to extract filename from inputlookup csv file with query

bimatomsoc — Thu, 30 Nov 2023 05:22:02 GMT

Thank you very much, Sir. Finally, I got the solution based on your suggestion. I put the filename column and value in the csv file. That is the easy way to get the lookupfilename in search.