Splunk Search

After uploading a CSV file to an index, why is my current search not producing results from the uploaded CSV data?

cogrunc
New Member

Hello,

I have a problem about Data Input that is uploaded from my computer. I upload a CSV file and index the file into "indexFoo2". When I complete the "add data" stage, I can search and reach the CSV data in "indexFoo2". However, if I use the search below, all the CSV data is removed from "indexFoo2".

How to overcome this issue?

index="indexFoo1" | rex field=_raw "(?\S+)"|rex field=_raw "(\S(?\S+))\S+"|eval Foo2=upper(Foo2) | eval Foo2=replace(Foo2, "\.", "") |eval Foo3=Foo3x|fields Foo1,Foo3,Foo2| join type=left Foo3[search index="indexFoo2" |eval Foo3 =Foo3y|fields Foo1,Foo3,Foo2,Foo4]| eval Time=strftime(_time, "%H:%M:%S %d/%m/%y")| join type=left Foo2 [search "indexFoo3" earliest=-30d | eval Foo2=upper('Foo2x')  | stats count by Foo2|fields Foo1,Foo3,Foo2,Foo4 ]| eval Foo2=tostring(Foo2)| eval Foo2 = substr(Foo2,0,2).":".substr(Foo2,3,2).":".substr(Foo2,5,2).":".substr(Foo2,7,2).":".substr(Foo2,9,2).":".substr(Foo2,11,2)| search NOT count>0| table Foo3,Foo1,Foo4,Foo2
0 Karma

woodcock
Esteemed Legend

You forgot an index= between search and "indexFoo3". Rather than fix it as-is, try this enhanced overhaul:

 index="indexFoo1" OR index="indexFoo2" OR index="indexFoo3" |eval Foo2=upper(Foo2) | eval Foo2=replace(Foo2, "\.", "") |eval Foo3=if(index="indexFoo1", Foo3x, Foo3y) |fields Foo1,Foo3,Foo2,Foo4 | stats values(*) AS * BY Foo3 | where index="indexFoo1" | eval Time=strftime(_time, "%H:%M:%S %d/%m/%y") | appendpipe [index="indexFoo3" earliest=-30d | eval Foo2=upper('Foo2x') | stats count by Foo2 | fields Foo1,Foo3,Foo2,Foo4] | stats values(*) BY Foo2 | where index="indexFoo1" OR index=indexFoo2" | eval Foo2=tostring(Foo2)| eval Foo2 = substr(Foo2,0,2).":".substr(Foo2,3,2).":".substr(Foo2,5,2).":".substr(Foo2,7,2).":".substr(Foo2,9,2).":".substr(Foo2,11,2)| search NOT count>0| table Foo3,Foo1,Foo4,Foo2

Neither of your rex commands captured anything (named) so they did nothing so I removed them.

0 Karma

naidusadanala
Communicator

The lookup table can be uploaded at the context of the app level but not at the index level.
If the lookup table file name is "indexFoo2"

You can use the command |inputlookup indexFoo2 at that app level

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...