what is the difference between inputcsv and inputlookup?

[asmithe]

From the documentation it looks that the difference is mostly the file location of the input file.

Can anyone with more experience with these two search commands comment on why you might choose to use inputlookup vs. inputcsv?

[MuS]

@somesoni2: thanks for this hint! using append=t works, without you will get the must be first search command error 😉

[araitz · Accepted solution]

inputlookup treats the given lookup as input. If CSV files, lookups must be in $SPLUNK_HOME/etc/apps//lookups. Otherwise, they might be scripted or external_url lookups, in which case a script or URL is providing said input.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Inputlookup

inputcsv treats the given CSV file as input. CSV files can only be used if they live in $SPLUNK_HOME/var/run/splunk.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Inputcsv

[aelliott]

inputcsv can be treated as "events" by setting a flag that will allow for timecharts of the data.

[somesoni2]

Are you sure it should be the first command, I guess we can do things like "index=_internal | inputcsv abc.csv append=t"

[MuS]

as addition:
inputcsv must be the first command in a search, where as a lookup can be done anywhere in the search path

[somesoni2]

Portability of csv file can also be a factor for having a csv file added as lookup table file (under an app) so they can be deployed across various splunk instances as part of app package.

[somesoni2]

One difference I can see is that you can restrict the execution of the command/access to csv data using role security using inputlookup. (inputlookup loads data from lookup table file/lookup definition file permissions for which can be set)