All Apps and Add-ons

How to use inputlookup with realtime search

Builder

I want to create a search that populates a map with real-time data. But I also have data in a lookup table that I want to include using the inputlookup command. I want the data from the lookup to populate before the realtime search begins so the first points that populate on the map are from the lookup table. Does anyone know how this can be accomplished?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

You can use inputlookup in a real-time search as long as you set append=true. Here's an example:

  index=* OR index=_* | stats count by index | inputlookup append=true monitored_indexes.csv | fillnull | stats max(count) as count by index

Run that over a real-time window and you'll have the count of events from the search itself and the list of indexes without events filled in with count=0 by the inputlookup | fillnull | stats.

View solution in original post

SplunkTrust
SplunkTrust

You can use inputlookup in a real-time search as long as you set append=true. Here's an example:

  index=* OR index=_* | stats count by index | inputlookup append=true monitored_indexes.csv | fillnull | stats max(count) as count by index

Run that over a real-time window and you'll have the count of events from the search itself and the list of indexes without events filled in with count=0 by the inputlookup | fillnull | stats.

View solution in original post

Builder

This worked for me. Thanks!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!