inputlookup

[sd248011]

Hello,

I know to view a csv, I can run | inputlookup asdf.csv. How would I be able to view multiple csvs in one search query?

[alacercogitatus · Accepted solution]

A better solution would be:

|inputlookup file1.csv | inputlookup file2.csv append=t|...

[sd248011]

Ah, got it. Thanks much!

[alacercogitatus]

My initial answer had an append=t because I normally append lookups to search results. Try this: |inputlookup c2_zeus.csv | inputlookup DNS_DOMAINS_malware.csv append=t

[sd248011]

The c2_zeus.csv is the first. Then I have append=t after that and the second csv. My example above is exactly like how your query was stated originally. It just doesn't let you put a subsequent inputlookup command after the initial one.

[alacercogitatus]

You have them backwards. Swap the two. For each inputlookup after the first, you need "append=t"

[sd248011]

|inputlookup c2_zeus.csv append=t| inputlookup DNS_Domains_malware.csv

[alacercogitatus]

can you post your search that is failing?

[sd248011]

I do. It is because inputlookup is stated after the append. I can run the | inputlookup file1.csv just fine. It is the subsequent csvs I can't seem to also pull up.

[alacercogitatus]

make sure you have a | at the front of your search, and that it is the first command in the search.

[sd248011]

I receive this error:

Error in 'inputlookup' command: This command must be the first command of a search.

[martin_mueller]

inputlookup, append, inputlookup, append, ...?