topic regex on inputlookup (via python script ?) in Splunk Search

regex on inputlookup (via python script ?)

smhsplunk — Tue, 29 Sep 2020 09:10:46 GMT

I tried to use regex on inputlookup csv file, but seems that although Splunk regex works fine on search but
it doesnt work on inputlookup tables.

Is there anyway to add a python script that takes the input csv file and then gives me the parsed value from the regex to be piped for next processing ?

i.e.

| inputlookup data.csv python_regex_script.py | table regex_field

Also as a general question, is it possible to add python script in a splunk search query ?

Re: regex on inputlookup (via python script ?)

jeffland — Thu, 24 Mar 2016 14:19:45 GMT

Not sure what you intended to do, but if you had this lookup file:

customer     host        service
Customer1   ABC123431   Service1
Customer2   ABC123300   Service2
Customer3   ABC123321   Service3

And you are interested in what comes after the ABC in the host field, you can simply do this:

| inputlookup file.csv | rex field=host "ABC(?<host_id>\d+)" | table customer host host_id service

The rex command will extract any regular expression from any field you tell it to, no matter the source.

Re: regex on inputlookup (via python script ?)

richgalloway — Thu, 24 Mar 2016 14:26:07 GMT

One cannot use a regex with inputlookup directly. However, there are other options.

If you're running 6.3.3, you may be able to use inputlookup's where argument to filter the lookup data
Pipe the lookup to regex as in |inputlookup data.csv foo | regex "some regex string" | ...
Create a custom command that reads and processes your CSV file. See the script command at http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Script and "About writing custom search commands" at http://docs.splunk.com/Documentation/Splunk/6.3.3/Search/Aboutcustomsearchcommands.

Re: regex on inputlookup (via python script ?)

smhsplunk — Thu, 24 Mar 2016 17:14:27 GMT

Thanks! I am going through the examples right now.
Will get back if I run into any issues.