topic How do I search a csv file created via Outputlookup? in Splunk Search

How do I search a csv file created via Outputlookup?

mshapirovp — Tue, 08 Jul 2014 13:28:57 GMT

I am creating lookup csv files for my app on a nightly basis via scheduled searches doing search | outputlookup mydata.csv.

I have verified that the mydata.csv exists under my app's lookups directory, and it contains the correct data. However, when running inputlookup mydata.csv no results come back.

What am I doing wrong?

Re: How do I search a csv file created via Outputlookup?

grijhwani — Tue, 08 Jul 2014 13:30:39 GMT

Perhaps a flaw in your inputlookup usage, but if you don't post an example search we cannot see.

Re: How do I search a csv file created via Outputlookup?

mshapirovp — Tue, 08 Jul 2014 13:32:02 GMT

I had actually posted the complete search I was trying in the post itself, but I just across a "ah-ha" moment that showed me what I was doing wrong. I needed to add a pipe before the inputlookup command before I would get results

Re: How do I search a csv file created via Outputlookup?

mshapirovp — Tue, 08 Jul 2014 13:36:45 GMT

It appears that you must start the search with a pipe. I was trying:

inputlookup mydata.csv

But got no results. What I should have been searching for was:

| inputlookup mydata.csv

That pipe made it work.

Re: How do I search a csv file created via Outputlookup?

grijhwani — Tue, 08 Jul 2014 17:05:59 GMT

That'll do it...