Splunk Search

How can I iterate through this lookup by the 'no' field and display each entry as a result?

arunkuriakose
Explorer

Hi 

 

I have a lookup which looks like this

no  name     student     rollno

1      john           yes           12

2       George     no             2345

3      jin                yes          111

 

How can i iterate through this lookup by the 'no' field and display each entry as a result . I only need one result at a time

so when i first run the search the result should be

no  name     student     rollno

1      john           yes           12

 

When i run the same search after a minute the result should be

 

no  name     student     rollno

2       George     no             2345

 

 

Please help

Labels (2)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

There are not many ways to store and retrieve state between searches.  One idea is to use an auxiliary lookup file.  Let's call it displayed.csv.

| inputlookup mylookup
| lookup displayed.csv no OUTPUT rollno AS displayed
| where isnull(displayed)
| sort no
| head 1
| outputlookup append=true displayed.csv

Lookup displayed.csv must be set up before hand, to the destination outputlookup will write into.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...