topic How to use INPUTLOOKUP command in splunk in Splunk Search

How to use INPUTLOOKUP command in splunk

abhayneilam — Tue, 16 Oct 2012 17:41:41 GMT

Hi ,

I am new to splunk, I want to seach multiple keywords from a list ( .txt ) , I would like to know how it could be done using "inputlookup" command ..

Please help !!

Thanks
Abhay

Re: How to use INPUTLOOKUP command in splunk

theouhuios — Tue, 16 Oct 2012 17:45:55 GMT

Splunk in general will need a .csv or a tarred version of .csv file to be used. So AFAIK it won't read data from .txt file.

Re: How to use INPUTLOOKUP command in splunk

abhayneilam — Tue, 16 Oct 2012 18:12:46 GMT

ok. even if it reads from .csv , can u please give me one example how it can be used.

Please help

Re: How to use INPUTLOOKUP command in splunk

ChrisG — Tue, 16 Oct 2012 18:27:53 GMT

The lookup file must be .csv or .csv.gz. There are some brief examples in the Search Reference.

Re: How to use INPUTLOOKUP command in splunk

_d_ — Wed, 17 Oct 2012 04:07:39 GMT

Assume you define a lookup table as described here: http://docs.splunk.com/Documentation/Splunk/5.0/Knowledge/Addfieldsfromexternaldatasources

Further, assume that the lookup is called foo and its associated file looks as such:

status, category 200, good 400, bad 500, worse

1.You can use the following search that utilizes the inputlookup command to search on status=values:

"index=my_index [| inputlookup foo | return 10 status]"

which translates to :

"index=my_index (status="200") OR (status="400") OR (status="500")"

2.To search ONLY on status values:

index=my_index [| inputlookup foo | return 10 $status]

which translates to:

index=my_index (200) OR (400) OR (500)

Hope this helps,

Re: How to use INPUTLOOKUP command in splunk

abhayneilam — Wed, 17 Oct 2012 08:06:09 GMT

But if I want to output, the no. of occurence for each Status code : like

Status_Code Count
200 5
300 2
400 10
500 1
600 30

Please help me regarding this

Re: How to use INPUTLOOKUP command in splunk

jeff — Thu, 29 Nov 2012 19:26:32 GMT

Following the example above:

index=my_index [| inputlookup foo | return 10 status] | stats count by status

Should get you what you want.

Re: How to use INPUTLOOKUP command in splunk

rashid47010 — Mon, 23 May 2016 07:36:59 GMT

where should we copy that file

Re: How to use INPUTLOOKUP command in splunk

soumyasaha25 — Tue, 29 Sep 2020 17:03:27 GMT

I have a requirement that is somewhat similar:
i have a list of query strings (these are just strings not a field)
(eg. Too many open files, CPU Starvation detected, java.sql.SQLException: Cannot obtain connection, thread(s) in total in the server that may be hung, Trust Association Init Error, problems occurred during startup for, OutOfMemoryError)
My requirement is to save these strings in a field and then run a query like
index=abc sourcetype=xyz "field_name" |stats count by field_name
I have already saved these queries in a lookup csv, but unable to reference the lookup file to run the query

my intention is to create a logic to use the lookup file so that in a rare event if there are any changes/addition/deletion to the query strings, no one touches the actual query, just a change/addition/deletion in the lookup file would be enough.

when i run |inputlookup search_string.csv | return 15 $search_string
i get the output as
(Too many open files) OR (CPU Starvation detected) OR (java.sql.SQLException: Cannot obtain connection:) OR (thread(s) in total in the server that may be hung)
how do i write a query so that it searches all the strings individually and later when i do a stats gives me a occurance count of each string.

Re: How to use INPUTLOOKUP command in splunk

gjanders — Mon, 04 Dec 2017 07:27:24 GMT

Please open a new question for the above, commenting on the existing one is unlikely to obtain an appropriate answer.

Re: How to use INPUTLOOKUP command in splunk

vijaysubramania — Wed, 17 Mar 2021 22:05:44 GMT

Hi, If i want to count the no of responseStatus, how do you achieve that.

For exaple I want to update the file with No of 200, 201, 203, 204, every 10 mins.

I want to use this data in future to plot my Charts

Re: How to use INPUTLOOKUP command in splunk

SubtotalAMG — Fri, 02 Jun 2023 16:43:57 GMT

Hi, I still don't understand the difference between $<field> and <fields>. Can you ELI5?