Splunk Enterprise

How to combine indexed data with an inputlookup csv file?

pred312
Engager

Hello,

I have uploaded several csv files into Splunk that contain historical data values for storage usage over time. I would like to combine the csv data with more recent data that is currently being indexed in Splunk going back to only 6 months. I would like to combine the historical 2 years worth of data on the csv files with the 6 months that Splunk is indexing, and use this combined search to begin building a predictive model with 2.5 years worth of storage usage/total size over time. Any help is appreciated, thanks!

0 Karma

poete
Builder

As written in somesoni2's comment, something like this should do the trick:

|inputlookup <yourlookuptable> | append [search index=<nameoftheindexcontainingthelast6monthdata> ...]

Also refer to: https://docs.splunk.com/Documentation/SplunkCloud/7.0.3/SearchReference/Append

somesoni2
Revered Legend

And based on which search (inputlookup or your indexed data search) has higher number of records, that one should be run as subsearch.

0 Karma

somesoni2
Revered Legend

How have you uploaded your historical CSV data, as a lookup table file OR indexed data? If it's lookup table file and has less than 10k records, you can append the CSV result to your indexed data search using append command.

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...