Can't I read file in this directory, or should I use alert action to output csv?

[phamxuantung]

Hello,

I have a search query that have a |outputlookup report.csv at the end, and save that as an alert to run daily.

But when I want to check it using |inputlookup report.csv, it's found no result.

I check the job inspection of the alert and found the csv was ouputed at splunk/var/run/splunk/csv

Can't I read file in this directory, or should I use alert action to output csv?

[gcusello · Accepted solution]

Hi @phamxuantung,

at first, as @chaker hinted, check if the outputcsv search gives results.

Then I need an additional information: report.csv is a csv file or a lookup? in other words: did you created a lookup called reports.csv?

Inputlookup is a command that read lookups not csv files, so you should create a lookup, called reports.csv to use it.

Otherwise, to directly read a csv file, you shuld use the inputcsv command (https://docs.splunk.com/Documentation/Splunk/9.0.0/SearchReference/Inputcsv) instead of inputlookup.

Ciao.

Giuseppe

[gcusello]

Hi @phamxuantung,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

[chaker]

The first thing to check is that your daily report produces results. Remove |outputlookup and run.

If append=false is set in the outputlookup, it will overwrite the prior results, which could be an empty set.

The alert action, and what you are doing with outputlookup are the same I believe.

[phamxuantung]

My query certainly produce results, and the file in var/splunk/csv also have that result but I can't use inputlookup.

Curiously, when I ran |inputcsv I can read it alright.

Maybe because I use |outputcsv so I have to use |inputcsv to read it.

Similarly, maybe I should use |outputlookup to use |inputlookup