Getting Data In

Using inputlookup to enrich results table with a common field between search and CSV

373782073
Explorer

Hi,
I am trying to use an inputlookup to enrich my search results table with additional fields from my inputlookup csv.
The scenario is that I am using a search to look for hostnames from events to match my CSV Device Name field and add the model number from my CSV also. I plan to add several more fields from my CSV but model field values is a start. I have tried to run the inputlookup sub-search but struggling to associate fields that are named differently between my search results and my CSV column titles.

Many thanks

Tags (2)
0 Karma
1 Solution

arjunpkishore5
Motivator

Based on what you described, what you need is the lookup command

<your search>
|lookup <lookupfile> "Device Name" as hostname OUTPUT <comma separated fields from lookup>

Lookup documentation here - https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Lookup

Hope this helps.
Cheers

View solution in original post

arjunpkishore5
Motivator

Based on what you described, what you need is the lookup command

<your search>
|lookup <lookupfile> "Device Name" as hostname OUTPUT <comma separated fields from lookup>

Lookup documentation here - https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Lookup

Hope this helps.
Cheers

373782073
Explorer

That did the trick. Not sure why I steered into looking at inputlookup. Would you have any examples on applying inputlookup ?

0 Karma

arjunpkishore5
Motivator

There are multiple scenarios you use inputlookup
For example:
1. | inputlookup <lookup file> This just outputs the content of the lookup file
2. <your search> |inputlookup <lookup file> append=true This appends the content of your lookup file to the end of your search results

You can view more examples here - https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Inputlookup

Cheers

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...