topic Re: | input lookup return ALL rather than specify number in Splunk Search

| input lookup return ALL rather than specify number

robf — Fri, 16 Jan 2015 10:09:30 GMT

I'm trying to add this to my search but the number of lookup users may change!!

(|inputlookup lotsofusers.csv | return 3 $users)

((user1) OR (user2) OR (user3))

Is there a better way to do this? * does not work.

Thanks

Re: | input lookup return ALL rather than specify number

fdi01 — Fri, 16 Jan 2015 11:40:01 GMT

try as:
[|inputlookup lotsofusers.csv | return 3 $users]

Re: | input lookup return ALL rather than specify number

robf — Fri, 16 Jan 2015 12:38:33 GMT

i dont think you understood the question... i don't want to specify how many users. it could be 3 , 300, 3333...

Re: | input lookup return ALL rather than specify number

aweitzman — Fri, 16 Jan 2015 14:02:02 GMT

If you're using it as a subsearch, you can use the fields command to reduce what gets returned without needing return. Try this:

[|inputlookup lotsofusers.csv | fields users]

You should get all of them.

Re: | input lookup return ALL rather than specify number

robf — Fri, 16 Jan 2015 17:13:05 GMT

thanks but this gives

((user=user1) OR (user=user2) OR (user=user3))

i want to search keywords only

((user1) OR (user2) OR (user3))

with the return command you can use the $ symbol to achieve this

Re: | input lookup return ALL rather than specify number

aweitzman — Fri, 16 Jan 2015 17:27:14 GMT

How about this:

[|inputlookup lotsofusers.csv | fields users | format | rex field=search mode=sed "s/user=//g"]

Re: | input lookup return ALL rather than specify number

somesoni2 — Fri, 16 Jan 2015 19:14:24 GMT

Give this a try

your base search  [|inputlookup lotsofusers.csv | eval search=users | table search]

Re: | input lookup return ALL rather than specify number

orion44 — Wed, 12 Jun 2019 23:36:59 GMT

It would be nice to know the answer to this question. Why do we have to specify a hardcoded value of records to return when using inputlookup? The logical thing to do is check all records.