topic Re: What does format do after a table lookup in Splunk Search

What does format do after a table lookup

OldManEd — Tue, 29 Sep 2020 18:53:58 GMT

I inherited a search that contains he following line;

[| inputlookup <lookup table name> | format ]

and I can't figure out what it does. The table contains one column with a title of my_field. The data is numbers and subnet addresses, (Like 1.2.3.4/24). Now there is a field from the raw event called my_field, but I can't figure out how everything works together.

After the line there is the ~stats~ portion of the search that summarizes the data and my_field is mentioned like below;

| stats sum(field_b) by my_field

but I'm not sure what the lookup does for me. I guess I'm trying to understand what the inputlookup format above does. I can't really find anything in the docs.

Re: What does format do after a table lookup

mayurr98 — Fri, 06 Apr 2018 17:16:45 GMT

FORMAT- This command is used implicitly by subsearches. This command takes the results of a subsearch, formats the results into a single result and places that result into a new field called search.
Refer this doc for more info.
https://docs.splunk.com/Documentation/Splunk/7.0.3/SearchReference/Format
You can run | inputlookup <lookup table name> | format seperately to see what you get in search field and then you may try to understand query.

let me know if this helps!

Re: What does format do after a table lookup

elliotproebstel — Fri, 06 Apr 2018 17:22:10 GMT

Based on your description of the search, I suspect the search is structured to use the data in the lookup file as a search filter, which will narrow the results of the base search to only events containing my_field values that are present in the lookup file.

As @mayurr98 pointed out, the format command itself isn't really doing much in the context of this search, because it's used implicitly in subsearches anyway.

If I'm correct about the intention of the user who wrote the search, it's probably structured like this:

index=something sourcetype=whatever 
[| inputlookup <lookup table> 
 | format ] 
| stats sum(field_b) by my_field

Re: What does format do after a table lookup

OldManEd — Fri, 06 Apr 2018 19:10:49 GMT

Thanks. It makes a lot more sense now.