inputlookup usage to fetch fields having another name in data

[ksharma7]

I have a query like :

index=rxc sourcetype=rxcapp splunk_server_group="" status=2 [| inputlookup quote.csv | fields name | rename name as questname]

I have a data which has field named questname which has all values that are there in name column of my csv and some other values too ....I want to use the same csv without manipulating it but want data in my query specific to name present in cvs and not for all questname and then work on it how to do that .

the above does not seems to be working

[gcusello · Accepted solution]

Hi @ksharma7,
At first I always put the fields command at the end of the subsearch:

index=rxc sourcetype=rxcapp splunk_server_group="" status=2 [ | inputlookup quote.csv | rename name as questname | fields questname  ]

but it souldn't be the solution to you problem.

One question: data in index rxc and in the quote.csv lookup are exactly the same or a part of them, in othe words, do you have e.g. "server_one" in both or "server_one" in the first and "server" in the second?
if the first case, the search is correct, otherwise, you have to use "*" or the ful text search:

index=rxc sourcetype=rxcapp splunk_server_group="" status=2 [ | inputlookup quote.csv | rename name as query| fields query ]

Ciao.
Giuseppe

[ksharma7]

Hi @gcusello

actually lookup has only some fields which are important to us like
name id part branch

I just to to look for those name in my query which are there in my lookup

also in my index=rxc sourcetype=rxcapp the field has name questname which has similar values to the "name" in my csv. so what should be right approach
or can I just use |lookup quote.csv name as questname|

and the look or do stats whatever I want to do with questname

[gcusello]

Hi @ksharma7,
the use of lookup or inputlookup command depends on your requirement: if you need to search for the values of lookup, you have to use inputllokup, if you want to add lookup informations to the search, you use lookup.
For what I understood, you have to filter your search results for the names in the lookup, in this case the solution is:

index=rxc sourcetype=rxcapp splunk_server_group="" status=2 [ | inputlookup quote.csv | rename name as questname | fields questname  ]

but, as I said, the question is: names in lookup fully match questnames or not?

Having a different name in lookup isn't a problem because you can use the rename; even if, when possible, I try to give to the lookup fields the same name of the fields search .

Ciao.
Giuseppe

[ksharma7]

I think I got it..mistake was using fields before ...using it afterwards is working .thanks