Splunk Cloud Platform

Inputlookup help

irishmanjb
Path Finder

Hello

I currently get CSV results from a daily import into Splunk.  The first field is a serial number in this format INA field called "Serial Number" like this "xxx-xxx-xxx" it is the first field in the raw_data results.

I have a lookup  called SerialNumber that has a series of serial numbers with the same format I want to check for in the daily report.  I have tested the lookup alone in Splunk and it works fine. It has about 20 serial numbers that I want to check for in the daily results. If there is a match just return the serial number or true

index="blah" sourcetype="blah:csv"
[ | inputlookup SerialNumber ]
fields 



thanks for your help

 

 

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

If your data and the CSV file use the same field names then this should work. 

index="blah" sourcetype="blah:csv"
  [ | inputlookup SerialNumber | format ]
| table *

If the field names are different then add a rename command within the subsearch.

index="blah" sourcetype="blah:csv"
  [ | inputlookup SerialNumber | rename "Serial Number" as serialNumber | format ]
| table *
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

If your data and the CSV file use the same field names then this should work. 

index="blah" sourcetype="blah:csv"
  [ | inputlookup SerialNumber | format ]
| table *

If the field names are different then add a rename command within the subsearch.

index="blah" sourcetype="blah:csv"
  [ | inputlookup SerialNumber | rename "Serial Number" as serialNumber | format ]
| table *
---
If this reply helps you, Karma would be appreciated.

irishmanjb
Path Finder

Thanks for the follow up!

0 Karma

anilchaithu
Builder

@irishmanjb 

This should work

index="blah" sourcetype="blah:csv"
[ | inputlookup SerialNumber | table filedname | format ]

The field name in the lookup should match with the field name in index. If its not the same use

rename fieldname as fieldname1 (fieldname1 is in the index)

If the field name has a white space like "Serial Number", wrap it in quotes like "filed name"

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...