Splunk Search

CSV Lookup for search query

Abdulm1
Explorer

I have a search query like this

index=ppt sm.to{}="12-12-518@dt.com" OR sm.to{}="050920@cp.com" |table sm.to{} sm.stat

and I want to use a csv lookup instead because I have more email address to use and I want the result to show this two fields .

My csv contains this
sm.to{}
050920@cp.com
12-12-518@dt.com
774211@PP.com
859@dat.com
20909@PP.com
07548@pp.com

Can anyone help with a lookup search query for me . thanks.

0 Karma
1 Solution

manjunathmeti
Champion

Try this:

index=ppt | lookup .csv sm.to{} OUTPUT sm.to{} as sm_to | search sm_to = *

View solution in original post

manjunathmeti
Champion

Try this:

index=ppt | lookup .csv sm.to{} OUTPUT sm.to{} as sm_to | search sm_to = *

Abdulm1
Explorer

am actaully using inputlookup so i used the below command but it did not work

index=proofpoint sourcetype=pps_maillog | inputlookup smto OUTPUT sm.to{} as sm_to | search sm_to = *

I tried the following as well but did not work
index=ppt
| eval Recipients='sm.to{}'
| table Recipients
| search Recipients = "*"
| join type=inner Recipients
[| inputlookup smto
| table sm.to{} sm.stat]

0 Karma

Abdulm1
Explorer

Thanks @manjunathmeti it worked perfectly.

index=ppt | lookup .csv sm.to{} OUTPUT sm.to{} as sm_to | search sm_to = * | table sm_to sm.stat

0 Karma

manjunathmeti
Champion

May be it's due to field name, rename sm.to{} to smto in csv file and search query and try.

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...