topic Re: serach not working with input csv in Splunk Search

serach not working with input csv

KarunK — Thu, 01 Dec 2011 06:35:52 GMT

Hi,

I have a input lookup file called "services" and I need to search all values of a field (channels) from that csv file to a new search. I am using append for this.

Here is my search

index="apache_logs" | append [ inputlookup services | fields channels ]

But the problem is I tried to validate the search by using the following, which is adding all the values of the field - channels using OR and i am getting different results.

index="apache_logs" channel1 OR channel2 OR channel3 .....OR channel25

Am i doing anything wrong here ?

Thanks fro your help.

Re: serach not working with input csv

Ayn — Thu, 01 Dec 2011 07:55:44 GMT

I'm struggling to understand the question. Maybe it's just me missing the meaning but I don't understand - could you explain the problem more clearly? Do you want to append the results from the services CSV rather than just use it for filtering the search?

I'm guessing you mean | append [|inputlookup services | fields channels] (with the | before inputlookup), otherwise Splunk would throw an error.

Re: serach not working with input csv

KarunK — Thu, 01 Dec 2011 22:29:42 GMT

I am trying to use the fields for filtering the search.

I want to search the index="apache_logs" with all the values of the field "channels" from lookup "services".

It would give me a result equivalent to

index="apache_logs" channel1 OR channel2 OR channel3 .....OR channel25

Re: serach not working with input csv

Ayn — Fri, 02 Dec 2011 06:29:13 GMT

Based on your goal it sounds like you shouldn't be using append at all. append is used for adding search results to the ones that are already there. It does not filter those search results.

Just remove | append and you should be good to go:

index="apache_logs" [| inputlookup services | fields channels ]

Re: serach not working with input csv

KarunK — Sun, 04 Dec 2011 23:14:23 GMT

Hi,
Thanks for that. It didn't work. But i have made some changes to the search and it seems to be working now (but need to validate it)

index="apache_logs" |search [| inputlookup services | fields channels ]

Re: serach not working with input csv

Ayn — Sun, 04 Dec 2011 23:17:42 GMT

That query is in practice identical to the one I wrote, so if one works but not the other that's kind of odd.