Getting Data In

Using inputlookup to enrich results table with a common field between search and CSV

373782073
Explorer

Hi,
I am trying to use an inputlookup to enrich my search results table with additional fields from my inputlookup csv.
The scenario is that I am using a search to look for hostnames from events to match my CSV Device Name field and add the model number from my CSV also. I plan to add several more fields from my CSV but model field values is a start. I have tried to run the inputlookup sub-search but struggling to associate fields that are named differently between my search results and my CSV column titles.

Many thanks

Tags (2)
0 Karma
1 Solution

arjunpkishore5
Motivator

Based on what you described, what you need is the lookup command

<your search>
|lookup <lookupfile> "Device Name" as hostname OUTPUT <comma separated fields from lookup>

Lookup documentation here - https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Lookup

Hope this helps.
Cheers

View solution in original post

arjunpkishore5
Motivator

Based on what you described, what you need is the lookup command

<your search>
|lookup <lookupfile> "Device Name" as hostname OUTPUT <comma separated fields from lookup>

Lookup documentation here - https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Lookup

Hope this helps.
Cheers

373782073
Explorer

That did the trick. Not sure why I steered into looking at inputlookup. Would you have any examples on applying inputlookup ?

0 Karma

arjunpkishore5
Motivator

There are multiple scenarios you use inputlookup
For example:
1. | inputlookup <lookup file> This just outputs the content of the lookup file
2. <your search> |inputlookup <lookup file> append=true This appends the content of your lookup file to the end of your search results

You can view more examples here - https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Inputlookup

Cheers

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...