How to display the contents of a lookup file?

[the_wolverine]

Is there a search that can be run to display the contents of a lookup file?

[dmenon]

I added following at end of above query - | table ip, "Vulnerabilities", "Severity", "Site ID" | outputlookup nexposetext.csv

When I do | inputlookup nexposetext.csv nothing shows up .

What I mean by data is getting mixed up is that the columns are grouped by IP address, when I export it to CSV the IP and vulnerabilities etc do not show up on csv like they show up neatly formatted on Splunk.

[russelljesse]

I'm sure you've gotten past this by now, but for future searchers that remained confused it might be because this is a generating command, so when trying to display it in a panel or search by itself, you specify a leading pipe charater |, so your FULL search bar looks like:

| inputlookup lookup_name.csv | table field1,field2,field3

You can create a handy dashboard panel to search the lookup table with a text box:

| inputlookup lookup_name.csv | table field1,field2,field3 | search field1="$token1$" OR field2="$token1$" OR field3="$token1$*"

where fieldX are your column names.

[jayakanthprasad]

Hi,

I would like to see the rows of my csv lookup file through a splunk query. Is there any option which reads the lookup file and prints all the rows of lookup file.

[SantoshBansode]

| inputlookup Lookup_File_Name.csv

[jayakanthprasad]

Hi,

I would like to see the rows of my csv lookup file through a splunk query. Is there any option which reads the lookup file and prints all the rows of lookup file.

[LAntoniak]

| inputlookup Lookup_File_Name.csv
| streamstats count as row

You'll have to use | outputlookup if you want to save the row numbers.

Note: If you plan to save it or do more manipulation with it later on you might want to make it into a zero padded string:
| eval row=substr("0000".row,-5)

[gkanapathy · Accepted solution]

| inputlookup mylookup