Splunk Search

Can you just search your lookup table?

sondradotcom
Path Finder

This may sound odd, but I wonder if there's a query that will just return your lookup table. Basically, I want to create a pulldown-driven form in Splunk, and I want to populate the pulldown with the contents of specific lookup table. I could just paste the values in, I suppose, but I don't want to maintain that list in two places. Alternatively, I could run a splunk query that would likely return all the results of that lookup table, but that seems like a lot of overhead. Any thoughts?

Thanks!
-S.

Tags (1)
1 Solution

Stephen_Sorkin
Splunk Employee
Splunk Employee

Absolutely. | inputlookup <lookup name> will pull the full lookup table.

View solution in original post

jagdeepgupta813
Explorer

Hello,

Can we search all the lookup table available in splunk ?
I tried below command but that didn't work

| inputlookup *.csv

0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

Absolutely. | inputlookup <lookup name> will pull the full lookup table.

Stephen_Sorkin
Splunk Employee
Splunk Employee

I wouldn't suggest timechart for this. Rather, add something like: | dedup

0 Karma

jbsplunk
Splunk Employee
Splunk Employee

| timechart span=1m distinct_count(value)

0 Karma

sondradotcom
Path Finder

Okay, follow up: what if you want a list of distinct values. My lookup has some values that show up more than once in the same column -- how do I filter it down to one time?

0 Karma

sondradotcom
Path Finder

I had a feeling. You splunk people are AWESOME! Truly.

Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...