Splunk Search

How can I use a search result as a filename variable of a inputlookup statement

apietersen
Path Finder

Hi,

I like to setup a kind of help-text library based on unique msgcode-xx.csv text files. (or internal/external tml pages/files)

With the code beneath I try to look for a filename in EVENTLIST_3v3 that I can use as an input for an appended inputlookup statement. Lookup goes ok, but I can not get it passed further as a filename argument for the next inputlookup statement.
Nb. the filename is stored in the EVENTLIST_3v3 .

What ever I tried nothing works sofar and I do not understand why a correct filename string can not be processed as parameter of a following (append,join etc) inputlookup command.

  • What do I miss here? Has some one have a clue?
  • Has some one have a better approach for this help-library functions (ie linking to html pages?)

| makeresults
| eval msgtxt="46 - No intervention needed" , msgcode=substr(msgtxt,0,2) | table msgcode
| lookup EVENTLIST_3v3 nr as msgcode OUTPUT helpdoc
| table helpdoc
| appendcols
[|inputlookup helpdoc | table *]

regards
Ashley Pietersen

0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

I do it like this on a dashboard:

| lookup 
[ 
 | makeresults count=1 
 | eval env="$VARIABLE_FROM_DROPDOWN$"
 | eval lookupname=case
 (
  match(env,"prod.*"), "prod",
  match(env,"uat.*"), "uat",
  match(env,"qa.*"), "qa"
 ) 
 | fields lookupname 
 | return $lookupname 
] fieldInLookup AS fieldInData OUTPUTNEW fieldsFromLookup

So to adapt it for your use case i think this would work:

|inputlookup
[
| makeresults 
| eval msgtxt="46 - No intervention needed" , msgcode=substr(msgtxt,0,2) 
| table msgcode
| lookup EVENTLIST_3v3 nr as msgcode OUTPUT helpdoc
| fields helpdoc
| return $helpdoc
] | table *

View solution in original post

0 Karma

jkat54
SplunkTrust
SplunkTrust

I do it like this on a dashboard:

| lookup 
[ 
 | makeresults count=1 
 | eval env="$VARIABLE_FROM_DROPDOWN$"
 | eval lookupname=case
 (
  match(env,"prod.*"), "prod",
  match(env,"uat.*"), "uat",
  match(env,"qa.*"), "qa"
 ) 
 | fields lookupname 
 | return $lookupname 
] fieldInLookup AS fieldInData OUTPUTNEW fieldsFromLookup

So to adapt it for your use case i think this would work:

|inputlookup
[
| makeresults 
| eval msgtxt="46 - No intervention needed" , msgcode=substr(msgtxt,0,2) 
| table msgcode
| lookup EVENTLIST_3v3 nr as msgcode OUTPUT helpdoc
| fields helpdoc
| return $helpdoc
] | table *

View solution in original post

0 Karma

apietersen
Path Finder

Hi jkat54,

Thanks for the code, that was very helpful. this works fine for what I am trying to achieve,.

I will need to look in to the details about your using "return $helpdoc" and the fact that you start with inputlookup which is the other way around as I did. Thanks again!!

My final code is now:

|inputlookup
     [
     | makeresults 
     | eval msgtxt="$nr$" , msgcode=substr(msgtxt,5,2) 
     | table msgcode
     | lookup EVENTLIST_3v3 nr as msgcode OUTPUT helpdoc
     | fields helpdoc
     | return $helpdoc
     ] | table help
best regards Ashley Pietersen

jkat54
SplunkTrust
SplunkTrust

Glad to help.

The return and format commands are essential when using subsearches.

Use this command reference for more details on those two commands:

http://docs.splunk.com/Documentation/Splunk/7.1.2/SearchReference/ListOfSearchCommands

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!