Getting Data In

Using inputlookup to enrich results table with a common field between search and CSV

373782073
Explorer

Hi,
I am trying to use an inputlookup to enrich my search results table with additional fields from my inputlookup csv.
The scenario is that I am using a search to look for hostnames from events to match my CSV Device Name field and add the model number from my CSV also. I plan to add several more fields from my CSV but model field values is a start. I have tried to run the inputlookup sub-search but struggling to associate fields that are named differently between my search results and my CSV column titles.

Many thanks

Tags (2)
0 Karma
1 Solution

arjunpkishore5
Motivator

Based on what you described, what you need is the lookup command

<your search>
|lookup <lookupfile> "Device Name" as hostname OUTPUT <comma separated fields from lookup>

Lookup documentation here - https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Lookup

Hope this helps.
Cheers

View solution in original post

arjunpkishore5
Motivator

Based on what you described, what you need is the lookup command

<your search>
|lookup <lookupfile> "Device Name" as hostname OUTPUT <comma separated fields from lookup>

Lookup documentation here - https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Lookup

Hope this helps.
Cheers

373782073
Explorer

That did the trick. Not sure why I steered into looking at inputlookup. Would you have any examples on applying inputlookup ?

0 Karma

arjunpkishore5
Motivator

There are multiple scenarios you use inputlookup
For example:
1. | inputlookup <lookup file> This just outputs the content of the lookup file
2. <your search> |inputlookup <lookup file> append=true This appends the content of your lookup file to the end of your search results

You can view more examples here - https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Inputlookup

Cheers

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...