Splunk Search

How to dynamically append the content of multiple lookup files?

Communicator

Hello there,

I am trying to dynamically append the content of multiple lookup files but I am not sure it is possible.

Here how I do for now:

| inputlookup geo_attr_countries.csv
| inputlookup append=true geo_attr_us_states.csv

It is working fine but I was wondering if I could build that search without having to explicitly list lookup files.

I can build a search to retrieve the lookups:

| rest /servicesNS/-/search/data/lookup-table-files splunk_server="local"
| search title="geo_attr*.csv"
| fields title

geo_attr_countries.csv
geo_attr_us_states.csv

But I do not see how I can use this to build the search.

I was thinking of something like:

| rest /servicesNS/-/search/data/lookup-table-files splunk_server="local"
| search title="geo_attr*.csv"
| fields title
| foreach title [| inputlookup append=true <<FIELD>>]

But I would get this error:

Error in 'foreach' command: Search pipeline may not contain non-streaming commands.

So I am stuck, any idea on how to achieve this?

Thanks in advance

0 Karma
1 Solution

Champion

You can do this using the map function.

| rest /servicesNS/-/search/data/lookup-table-files splunk_server="local"
| search title="geo_attr*.csv"
| map search="|inputlookup $title$"

View solution in original post

Champion

You can do this using the map function.

| rest /servicesNS/-/search/data/lookup-table-files splunk_server="local"
| search title="geo_attr*.csv"
| map search="|inputlookup $title$"

View solution in original post

Communicator

Damn, I did not know about this command, does it perfectly well!

Thanks a lot!

0 Karma

New Member

Hi Folks..

I have a similar requirement wherein I want the name of the lookup file to be print against the data from each of them in the following way. For some reason, the eval function is not giving the desired output. Can anyone help ?

| rest /servicesNS/-/search/data/lookup-table-files splunk_server="local"
| search title="geo_attr*.csv"
| map search="eval lkpnm=$title$ |inputlookup $title$ | stats dc(title) as Count | table lkpnm, Count"

This is giving me the correct count, but not the lookupname!

0 Karma

Communicator

Hi @swetvenk, I would do something like this :

| rest /servicesNS/-/search/data/lookup-table-files splunk_server="local" 
| search title="geo_attr*.csv" 
| map search="| makeresults | eval lkpnm=$title$ | append [| inputlookup $title$]| eventstats last(lkpnm) as lkpnm | search NOT _time="*""
| stats count by lkpnm
0 Karma

Communicator

Have you tried the same with | outputlookup append=true <> ?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!