Splunk Search

Creating Field from Inputlookup

TooManyQuestion
Explorer

Hello.
I'm trying to create a field for all events in a search. The field is a value from a inpulookup. There is no shared fields between the lookup and the search in the conventional sense. The organization of my lookup is as follows

ID     email1                            email2                           email3

1      ex1@gmail..com        ex2@gmail..com       ex3@gmail..com

2     ex4@gmail..com        ex5@gmail..com        ex6@gmail..com

3     ex7@gmail..com        ex8@gmail..com         ex9@gmail..com

4     ex10@gmail..com      ex11@gmail..com      ex12@gmail..com

 

 

|inputlookup email.csv
            | search ID = "1"
            | strcat email1", " email2", " email3 emails
            | table emails

 

The above searches gives me my desired output of
emails=ex1@gmail.com, ex1@gmail.com, ex1@gmail.com

 

But when I pop in into an eval statement to give each event that field/value I get an error about a malformed eval.

Below is the eval I am trying to do.

 

index=main (insert search here)
|eval test =[|inputlookup email.csv
            | search ID = "1"
            | strcat email1", " email2", " email3 emails
            | return $emails
            ]

 

 

Any help would be greatly appreciated. Thanks!

Labels (2)
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

Try

 

index=main (insert search here)
|eval [|inputlookup email.csv
            | search ID = "1"
            | strcat email1 ", " email2 ", " email3 emails
            | return emails
            ]

 

View solution in original post

renjith_nair
SplunkTrust
SplunkTrust

Try

 

index=main (insert search here)
|eval [|inputlookup email.csv
            | search ID = "1"
            | strcat email1 ", " email2 ", " email3 emails
            | return emails
            ]

 

View solution in original post

inventsekar
Super Champion

Hi @renjith_nair / all, 

index=main | eval [|inputlookup ..... |return emails]

for SPL newbies, could someone explain this "eval" part, thanks. 

 

Best Regards,

Sekar

TooManyQuestion
Explorer

Thanks! That got me there! I knew I was just messing up something small and couldn't work it out.

index=main (insert search here)
|eval [|inputlookup email.csv
            | search ID = "1"
            | strcat email1 ", " email2 ", " email3 emails
            | return emails
            ]

Just had to remove the emails before the subsearch otherwise it gave me "emails emails" as the field name!

renjith_nair
SplunkTrust
SplunkTrust

Yes, removed extra field. My bad, I forgot that 🙂

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.