Splunk Search

How to add inputlookup file in the query

Harish2
Path Finder

Hi ,
I have uploaded the lookupfile with application host and hostip details in the splunk.

i am not sure where to add this inputlookup file so that when i run this query i should get application details.
when i run this query i am getting only _time and ClientName  responsetime data, i need application details as well.

My Query:

index=app_cust_ctl sourcetype=applicationdata
|bin _time span=1s
|rex "\d{2}:\d{2}:\d{2}:\d{3} (?<responsetime>;\d+) ms"
|stats count(eval(Status="success")) as sucessapp, count(eval(Status="error")) as errorapp, avg(responsetime) as appresponsetime, max(responsetime) as maxresponsetime by _time application ClientName

|eval record="location"




Labels (1)
0 Karma
1 Solution
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...