https://community.splunk.com/t5/Splunk-Search/How-to-add-inputlookup-and-outputlookup-in-same-search/m-p/135938#M37187 <P>Found one such example from Splunk Add-on for ServiceNow :</P> <P>eventtype=snow_cmdb_ci_list | dedup sys_id | fields - _bkt, _cd,_indextime,_kv,_raw,_serial,_si,_sourcetype,_subsecond, punct, index, source, sourcetype | inputlookup append=t cmdb_ci_list_lookup | dedup sys_id | outputlookup cmdb_ci_list_lookup</P> Tue, 29 Sep 2020 09:42:20 GMT splunkdevabhi 2020-09-29T09:42:20Z https://community.splunk.com/t5/Splunk-Search/How-to-add-inputlookup-and-outputlookup-in-same-search/m-p/135936#M37185 <P>Hi!</P> <P>I would like to know if it is possible to add outputlookup and inputlookup in same search.<BR /> My purpose is to create a table dynamically and use it in other sub searches.</P> <P>I thought this can be possible by using subsearches but bit struggling with it.</P> <P>index=hoge<BR /> [ sub search <BR /> outputlookup<BR /> return ""<BR /> ]<BR /> [ | inputlookup xxxxx]</P> <P>but alsways the inputlookup runs before the outputlookup.</P> <P>Any suggestions ?</P> <P>Thanks,<BR /> Yu</P> Tue, 04 Feb 2014 04:33:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-add-inputlookup-and-outputlookup-in-same-search/m-p/135936#M37185 yuwtennis 2014-02-04T04:33:23Z https://community.splunk.com/t5/Splunk-Search/How-to-add-inputlookup-and-outputlookup-in-same-search/m-p/135937#M37186 <P>Subsearches always run before the outer searches, as for the order in which subsearches themselves run I don't think there's a guaranteed order for that.</P> <P>Please tell us more about exactly what you want to accomplish, with examples.</P> Tue, 04 Feb 2014 07:35:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-add-inputlookup-and-outputlookup-in-same-search/m-p/135937#M37186 Ayn 2014-02-04T07:35:22Z https://community.splunk.com/t5/Splunk-Search/How-to-add-inputlookup-and-outputlookup-in-same-search/m-p/135938#M37187 <P>Found one such example from Splunk Add-on for ServiceNow :</P> <P>eventtype=snow_cmdb_ci_list | dedup sys_id | fields - _bkt, _cd,_indextime,_kv,_raw,_serial,_si,_sourcetype,_subsecond, punct, index, source, sourcetype | inputlookup append=t cmdb_ci_list_lookup | dedup sys_id | outputlookup cmdb_ci_list_lookup</P> Tue, 29 Sep 2020 09:42:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-add-inputlookup-and-outputlookup-in-same-search/m-p/135938#M37187 splunkdevabhi 2020-09-29T09:42:20Z https://community.splunk.com/t5/Splunk-Search/How-to-add-inputlookup-and-outputlookup-in-same-search/m-p/135939#M37188 <P>eventtype=snow_cmdb_ci_list | dedup sys_id | fields - _bkt, _cd,_indextime,_kv,_raw,_serial,_si,_sourcetype,_subsecond, punct, index, source, sourcetype | inputlookup append=t cmdb_ci_list_lookup | dedup sys_id | outputlookup cmdb_ci_list_lookup</P> Tue, 29 Sep 2020 09:42:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-add-inputlookup-and-outputlookup-in-same-search/m-p/135939#M37188 splunkdevabhi 2020-09-29T09:42:22Z