Splunk Search
Highlighted

How to access fields within a subsearch / Inputlookup

Explorer

I cannot figure out how to use a variable to relate to a inputlookup csv field.

service_tier.csv

region, plan, price
USA, tier2, 100
CAN, tier1, 25

userserviceplans.csv

user, plan
mike, tier1
james, tier2

regions.csv

type, address, region
home, abc123, usa
work, 123cba, usa
home, xyz123, can
work 321xyz, can

I have a search that returns me a user, and their current region. I want to determine which address they have

|inputlookup servicetier.csv |eval user="mike" | eval TYPE="home"| join plan [|inputlookup userservice_plans.csv | where USER=user] | join type=inner region [|inputlookup regions.csv | where type=TYPE ] | where plan=tier1

the eval user, and eval TYPE are empty in the sub searches. If I hardcode the | where USER="mike" and | where type="HOME" I get the correct results.

How do I make my search visible to the subsearch lookups?

0 Karma
Highlighted

Re: How to access fields within a subsearch / Inputlookup

Explorer

Am I doing this wrong? How an search a lookup for specific field(s)

0 Karma
Highlighted

Re: How to access fields within a subsearch / Inputlookup

Contributor

Hi @wrussell12,

You can use command lookup.

For example:

| inputlookup service_tier.csv 
| eval user="mike" 
| eval TYPE="home" 
| lookup your_lookup.csv field1_from_lookup, field2_from_lookup output new_field_from_lookup

But keep in mind: lookup and join differences

If your use case requires you to use join then you can find this helpful - join.

0 Karma
Highlighted

Re: How to access fields within a subsearch / Inputlookup

SplunkTrust
SplunkTrust

Hi @wrussell12,

Use this instead to combine your three csv files together at minimum resource cost :

|inputlookup user_service_plans.csv where plan="tier1" AND user="mike" 
| lookup  service_tier.csv  plan
| eval region=lower(region), type="home" 
|lookup regions.csv region, type

Cheers,
David

0 Karma