https://community.splunk.com/t5/Splunk-Search/What-are-the-differences-between-the-lookup-and-inputlookup/m-p/207058#M60345 <P>Thanks! But yes, that command works. WE think we've figured out the problem which is that the file reached over 10MB in size, so splunk indexed/cached it. then, when we uploaded a new file (one that has 1234 in it), splunk is still using the old cached version. does anyone know where i can delete the tsidx file of the cached version? </P> Wed, 23 Dec 2015 17:13:11 GMT sel105 2015-12-23T17:13:11Z https://community.splunk.com/t5/Splunk-Search/What-are-the-differences-between-the-lookup-and-inputlookup/m-p/207054#M60341 <P>Is there any reason why this command would work:</P> <PRE><CODE>| inputlookup myfile | search SERIAL_NO "1234" | table X, Y, Z </CODE></PRE> <P>And this command would work:</P> <PRE><CODE>index=mydata serial_number="1234" | table subject </CODE></PRE> <P>But this command would not work:</P> <PRE><CODE>index=mydata serial_number="1234" | lookup myfile SERIAL_NO as serial_number output X, Y, Z | table subject, X, Y, Z </CODE></PRE> <P>And by "not work", I mean that the table command produces a result with "subject," but no X, Y, or Z..... the lookup is failing.</P> Tue, 22 Dec 2015 15:17:04 GMT https://community.splunk.com/t5/Splunk-Search/What-are-the-differences-between-the-lookup-and-inputlookup/m-p/207054#M60341 sel105 2015-12-22T15:17:04Z https://community.splunk.com/t5/Splunk-Search/What-are-the-differences-between-the-lookup-and-inputlookup/m-p/207055#M60342 <P>It might be important to note that this lookup file is one that we have to delete and replace monthly. we can't append because the data changes so much every month. </P> Tue, 22 Dec 2015 15:24:17 GMT https://community.splunk.com/t5/Splunk-Search/What-are-the-differences-between-the-lookup-and-inputlookup/m-p/207055#M60342 sel105 2015-12-22T15:24:17Z https://community.splunk.com/t5/Splunk-Search/What-are-the-differences-between-the-lookup-and-inputlookup/m-p/207056#M60343 <P>also probably worth noting that for, let's say, serial number 3333....which was in one of the previous versions of this lookup file, and is also in the newer version...... this command works fine. is the lookup file cached somewhere that only gets looked at when "|lookup" is run, but not when "|inputlookup" is run?</P> Tue, 22 Dec 2015 15:44:41 GMT https://community.splunk.com/t5/Splunk-Search/What-are-the-differences-between-the-lookup-and-inputlookup/m-p/207056#M60343 sel105 2015-12-22T15:44:41Z https://community.splunk.com/t5/Splunk-Search/What-are-the-differences-between-the-lookup-and-inputlookup/m-p/207057#M60344 <P>Does this command work? <CODE>| inputlookup myfile | search SERIAL_NO="1234" | table X, Y, Z</CODE> (note the = between SERIAL_NO and 1234) it may be that the fields are not correctly configured, thus <CODE>lookup myfile SERIAL_NO as serial_number output X, Y, Z</CODE> returns no values. </P> <P>The inputlookup command you use may be matching the string "1234" rather than the field SERIAL_NO, which is why it works. </P> Tue, 29 Sep 2020 08:12:40 GMT https://community.splunk.com/t5/Splunk-Search/What-are-the-differences-between-the-lookup-and-inputlookup/m-p/207057#M60344 jplumsdaine22 2020-09-29T08:12:40Z https://community.splunk.com/t5/Splunk-Search/What-are-the-differences-between-the-lookup-and-inputlookup/m-p/207058#M60345 <P>Thanks! But yes, that command works. WE think we've figured out the problem which is that the file reached over 10MB in size, so splunk indexed/cached it. then, when we uploaded a new file (one that has 1234 in it), splunk is still using the old cached version. does anyone know where i can delete the tsidx file of the cached version? </P> Wed, 23 Dec 2015 17:13:11 GMT https://community.splunk.com/t5/Splunk-Search/What-are-the-differences-between-the-lookup-and-inputlookup/m-p/207058#M60345 sel105 2015-12-23T17:13:11Z https://community.splunk.com/t5/Splunk-Search/What-are-the-differences-between-the-lookup-and-inputlookup/m-p/207059#M60346 <P>I don't know sorry. Hopefully someone else can help.</P> Thu, 24 Dec 2015 10:25:59 GMT https://community.splunk.com/t5/Splunk-Search/What-are-the-differences-between-the-lookup-and-inputlookup/m-p/207059#M60346 jplumsdaine22 2015-12-24T10:25:59Z