Splunk Search

How can I iterate through this lookup by the 'no' field and display each entry as a result?




I have a lookup which looks like this

no  name     student     rollno

1      john           yes           12

2       George     no             2345

3      jin                yes          111


How can i iterate through this lookup by the 'no' field and display each entry as a result . I only need one result at a time

so when i first run the search the result should be

no  name     student     rollno

1      john           yes           12


When i run the same search after a minute the result should be


no  name     student     rollno

2       George     no             2345



Please help

Labels (2)
0 Karma


There are not many ways to store and retrieve state between searches.  One idea is to use an auxiliary lookup file.  Let's call it displayed.csv.

| inputlookup mylookup
| lookup displayed.csv no OUTPUT rollno AS displayed
| where isnull(displayed)
| sort no
| head 1
| outputlookup append=true displayed.csv

Lookup displayed.csv must be set up before hand, to the destination outputlookup will write into.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...