Hi,
perhaps it is the wrong approach, but i try to use an inputlookup within a search and pass a value to this subsearch.
It looks like this:
index=myindex sourcetype=stype source=sourcename
|eval SourceHost =[|inputlookup transfer_nodes.csv
|search nodeId IN ($last_source_node_id$)
|fields name
|stats first(name) as SourceHost
|eval SourceHost="\"".SourceHost."\""
|return $SourceHost
]
|eval DestinationHost =[|inputlookup transfer_nodes.csv
|search nodeId IN ($last_dest_node_id$)
|fields name
|stats first(name) as DestinationHost
|eval DestinationHost="\"".DestinationHost."\""
|return $DestinationHost
]
|table name,SourceHost,DestinationHost
I get the following error: Error in 'eval' command: Failed to parse the provided arguments. Usage: eval dest_key = expression.
The problem is the passing of the value $last_source_node_id$ ($last_dest_node_id$)
I already tried to map the subsearch, then the passing works, but the result is not what i expected.
Finally I would like to use a macro like GetTransferNode($last_nodeId$)
Hope you have an idea how to solve it.
best regards and thank you in advance !
https://answers.splunk.com/answers/797495/pass-value-to-subsearch-with-inputlookup-1.html
I posted it twice, sorry
I maybe missing something in the detail or your use case, but is there a reason you cant use a normal lookup
rather than inputlookup
?
Are you able to provide some sample data?