Splunk Search

After uploading a CSV file to an index, why is my current search not producing results from the uploaded CSV data?

cogrunc
New Member

Hello,

I have a problem about Data Input that is uploaded from my computer. I upload a CSV file and index the file into "indexFoo2". When I complete the "add data" stage, I can search and reach the CSV data in "indexFoo2". However, if I use the search below, all the CSV data is removed from "indexFoo2".

How to overcome this issue?

index="indexFoo1" | rex field=_raw "(?\S+)"|rex field=_raw "(\S(?\S+))\S+"|eval Foo2=upper(Foo2) | eval Foo2=replace(Foo2, "\.", "") |eval Foo3=Foo3x|fields Foo1,Foo3,Foo2| join type=left Foo3[search index="indexFoo2" |eval Foo3 =Foo3y|fields Foo1,Foo3,Foo2,Foo4]| eval Time=strftime(_time, "%H:%M:%S %d/%m/%y")| join type=left Foo2 [search "indexFoo3" earliest=-30d | eval Foo2=upper('Foo2x')  | stats count by Foo2|fields Foo1,Foo3,Foo2,Foo4 ]| eval Foo2=tostring(Foo2)| eval Foo2 = substr(Foo2,0,2).":".substr(Foo2,3,2).":".substr(Foo2,5,2).":".substr(Foo2,7,2).":".substr(Foo2,9,2).":".substr(Foo2,11,2)| search NOT count>0| table Foo3,Foo1,Foo4,Foo2
0 Karma

woodcock
Esteemed Legend

You forgot an index= between search and "indexFoo3". Rather than fix it as-is, try this enhanced overhaul:

 index="indexFoo1" OR index="indexFoo2" OR index="indexFoo3" |eval Foo2=upper(Foo2) | eval Foo2=replace(Foo2, "\.", "") |eval Foo3=if(index="indexFoo1", Foo3x, Foo3y) |fields Foo1,Foo3,Foo2,Foo4 | stats values(*) AS * BY Foo3 | where index="indexFoo1" | eval Time=strftime(_time, "%H:%M:%S %d/%m/%y") | appendpipe [index="indexFoo3" earliest=-30d | eval Foo2=upper('Foo2x') | stats count by Foo2 | fields Foo1,Foo3,Foo2,Foo4] | stats values(*) BY Foo2 | where index="indexFoo1" OR index=indexFoo2" | eval Foo2=tostring(Foo2)| eval Foo2 = substr(Foo2,0,2).":".substr(Foo2,3,2).":".substr(Foo2,5,2).":".substr(Foo2,7,2).":".substr(Foo2,9,2).":".substr(Foo2,11,2)| search NOT count>0| table Foo3,Foo1,Foo4,Foo2

Neither of your rex commands captured anything (named) so they did nothing so I removed them.

0 Karma

naidusadanala
Communicator

The lookup table can be uploaded at the context of the app level but not at the index level.
If the lookup table file name is "indexFoo2"

You can use the command |inputlookup indexFoo2 at that app level

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.