Dashboards & Visualizations

How to return values from lookup table based on input given?

amitrinx
Explorer

I have a lookup table with three columns Endpoints, Rate, Window
I want to get the window value for a particular endpoint provided by me which i will use in my main query

The Query looks like this

sourcetype="blabla" http_url = "some endpoint"
minutesago= |inputlookup SomeFile.csv | search Endpoint = "Some endpoint" | return Window

I get an error running this query
Error in 'search' command: Unable to parse the search: Comparator '=' is missing a term on the right hand side.

Can anyone help?

Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

It looks like you're trying to use a subsearch without putting the subsearch inside brackets.

sourcetype="blabla" http_url = "some endpoint"
minutesago=[|inputlookup SomeFile.csv | search Endpoint = "Some endpoint" | return $Window]

Using $Window tells the return command to return only the field value rather than a key/value pair.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...