Splunk Search

How do I search a csv file created via Outputlookup?

mshapirovp
Explorer

I am creating lookup csv files for my app on a nightly basis via scheduled searches doing search | outputlookup mydata.csv.

I have verified that the mydata.csv exists under my app's lookups directory, and it contains the correct data. However, when running inputlookup mydata.csv no results come back.

What am I doing wrong?

Tags (1)
0 Karma

mshapirovp
Explorer

It appears that you must start the search with a pipe. I was trying:

inputlookup mydata.csv

But got no results. What I should have been searching for was:

| inputlookup mydata.csv

That pipe made it work.

grijhwani
Motivator

That'll do it...

0 Karma

mshapirovp
Explorer

I had actually posted the complete search I was trying in the post itself, but I just across a "ah-ha" moment that showed me what I was doing wrong. I needed to add a pipe before the inputlookup command before I would get results

0 Karma

grijhwani
Motivator

Perhaps a flaw in your inputlookup usage, but if you don't post an example search we cannot see.

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...