How to combine indexed data with an inputlookup csv file?

[pred312]

Hello,

I have uploaded several csv files into Splunk that contain historical data values for storage usage over time. I would like to combine the csv data with more recent data that is currently being indexed in Splunk going back to only 6 months. I would like to combine the historical 2 years worth of data on the csv files with the 6 months that Splunk is indexing, and use this combined search to begin building a predictive model with 2.5 years worth of storage usage/total size over time. Any help is appreciated, thanks!

[somesoni2]

How have you uploaded your historical CSV data, as a lookup table file OR indexed data? If it's lookup table file and has less than 10k records, you can append the CSV result to your indexed data search using append command.

[poete]

As written in somesoni2's comment, something like this should do the trick:

|inputlookup <yourlookuptable> | append [search index=<nameoftheindexcontainingthelast6monthdata> ...]

Also refer to: https://docs.splunk.com/Documentation/SplunkCloud/7.0.3/SearchReference/Append

[somesoni2]

And based on which search (inputlookup or your indexed data search) has higher number of records, that one should be run as subsearch.