Getting Data In

How do I search a match a specific source against an input lookup

blueumbrella
New Member

I am attempting to run the below, however I am not getting any results.
source="source.tsv" [|inputlookup appname| fields inputfield AS "field"]

I can search source="source.tsv" and get the fields displayed, and |inputlookup appname| fields inputfield AS "field" and displays fine, but when I attempt to combine them to get a match, I get no results. I understand that this only provides a result when there is a match but I have inserted a field that should trigger a match.

Can anyone please help point me in the right direction?

0 Karma

renjith_nair
Legend

@blueumbrella,

You could use just lookup instead of inputlookup

E.g.

source="source.tsv" |lookup appname  inputfield AS "field"  OUTPUT "your required fields from lookup"
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...