Hi
I cross the results of a subsearch with a main search like this
index=toto [inputlookup test.csv
|eval user=Domain."\\"Sam
|table user]
|table _time user
Imagine I need to add a new lookup in my search
For example i would try to do something like this
index=toto [inputlookup test.csv OR inputlookup test2.csv
|eval user=Domain."\\"Sam
|table user]
|table _time user
How to do this please?
Hi @jip31,
you have to set the OR condition before the subsearch, something like this:
index=toto ([ | inputlookup test.csv OR inputlookup test2.csv | eval user=Domain."\\"Sam | table user ] OR [ | inputlookup test2.csv | eval user=Domain."\\"Sam | table user ])
| table _time user
Ciao.
Giuseppe
Try this by combining the two lookups using append for the second lookup
index=toto [
| inputlookup test.csv
| inputlookup test2.csv append=t
| eval user=Domain."\\".Sam
| table user]
| table _time user
I believe there is a missing '.' in your eval statement setting up user and 'Sam' is a field name?
Hi @jip31,
you have to set the OR condition before the subsearch, something like this:
index=toto ([ | inputlookup test.csv OR inputlookup test2.csv | eval user=Domain."\\"Sam | table user ] OR [ | inputlookup test2.csv | eval user=Domain."\\"Sam | table user ])
| table _time user
Ciao.
Giuseppe
Just pointing out here that the statement
| inputlookup test.csv OR inputlookup test2.csv
is not valid Splunk - you cannot do two inputlookup commands like that.
Hi @jip31 ,
good for you, see next time!
Ciao and happy splunking
Giuseppe
P.S.: Karma Points are appreciated by all the contributors 😉