Splunk Search

How to create a search with 2 columns in lookup?

ejulien
Engager

I would like to do a search using 2 columns in a lookup table where the row is AND'd.  Something like

Col1 Col2
A 1
B 2
C 3
D 4

 

where the search would be equivalent to

index=myindex (Col1=A AND Col2=1) OR (Col1=B AND Col2=2) OR (Col1=C AND Col2=3) OR (Col1=D AND Col2=4)
Labels (2)
Tags (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

@ejulien 

Try this

index=myindex [ | inputlookup yourlookup.csv | table Col1 Col2 ]

You can see the effect of the subsearch by running just this command

| inputlookup yourlookup.csv | table Col1 Col2 | format

Hope this helps

 

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust

@ejulien 

Try this

index=myindex [ | inputlookup yourlookup.csv | table Col1 Col2 ]

You can see the effect of the subsearch by running just this command

| inputlookup yourlookup.csv | table Col1 Col2 | format

Hope this helps

 

0 Karma

ejulien
Engager

@bowesmana thanks.  It looks like it works.

I was getting some errors with this answer initially, but it was because my actual search has a rex statement right before the inputlookup line.  I found the putting a "| search *" between the two fixed the error.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...