Archive

what is the difference between inputcsv and inputlookup?

Path Finder

From the documentation it looks that the difference is mostly the file location of the input file.

Can anyone with more experience with these two search commands comment on why you might choose to use inputlookup vs. inputcsv?

Tags (2)
1 Solution

Splunk Employee
Splunk Employee

inputlookup treats the given lookup as input. If CSV files, lookups must be in $SPLUNK_HOME/etc/apps//lookups. Otherwise, they might be scripted or external_url lookups, in which case a script or URL is providing said input.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Inputlookup

inputcsv treats the given CSV file as input. CSV files can only be used if they live in $SPLUNK_HOME/var/run/splunk.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Inputcsv

View solution in original post

SplunkTrust
SplunkTrust

@somesoni2: thanks for this hint! using append=t works, without you will get the must be first search command error 😉

Splunk Employee
Splunk Employee

inputlookup treats the given lookup as input. If CSV files, lookups must be in $SPLUNK_HOME/etc/apps//lookups. Otherwise, they might be scripted or external_url lookups, in which case a script or URL is providing said input.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Inputlookup

inputcsv treats the given CSV file as input. CSV files can only be used if they live in $SPLUNK_HOME/var/run/splunk.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Inputcsv

View solution in original post

Motivator

inputcsv can be treated as "events" by setting a flag that will allow for timecharts of the data.

0 Karma

Revered Legend

Are you sure it should be the first command, I guess we can do things like "index=_internal | inputcsv abc.csv append=t"

0 Karma

SplunkTrust
SplunkTrust

as addition:
inputcsv must be the first command in a search, where as a lookup can be done anywhere in the search path

0 Karma

Revered Legend

Portability of csv file can also be a factor for having a csv file added as lookup table file (under an app) so they can be deployed across various splunk instances as part of app package.

0 Karma

Revered Legend

One difference I can see is that you can restrict the execution of the command/access to csv data using role security using inputlookup. (inputlookup loads data from lookup table file/lookup definition file permissions for which can be set)

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!