Splunk Search

How to dynamically append the content of multiple lookup files?

D2SI
Communicator

Hello there,

I am trying to dynamically append the content of multiple lookup files but I am not sure it is possible.

Here how I do for now:

| inputlookup geo_attr_countries.csv
| inputlookup append=true geo_attr_us_states.csv

It is working fine but I was wondering if I could build that search without having to explicitly list lookup files.

I can build a search to retrieve the lookups:

| rest /servicesNS/-/search/data/lookup-table-files splunk_server="local"
| search title="geo_attr*.csv"
| fields title

geo_attr_countries.csv
geo_attr_us_states.csv

But I do not see how I can use this to build the search.

I was thinking of something like:

| rest /servicesNS/-/search/data/lookup-table-files splunk_server="local"
| search title="geo_attr*.csv"
| fields title
| foreach title [| inputlookup append=true <<FIELD>>]

But I would get this error:

Error in 'foreach' command: Search pipeline may not contain non-streaming commands.

So I am stuck, any idea on how to achieve this?

Thanks in advance

0 Karma
1 Solution

HiroshiSatoh
Champion

You can do this using the map function.

| rest /servicesNS/-/search/data/lookup-table-files splunk_server="local"
| search title="geo_attr*.csv"
| map search="|inputlookup $title$"

View solution in original post

HiroshiSatoh
Champion

You can do this using the map function.

| rest /servicesNS/-/search/data/lookup-table-files splunk_server="local"
| search title="geo_attr*.csv"
| map search="|inputlookup $title$"

D2SI
Communicator

Damn, I did not know about this command, does it perfectly well!

Thanks a lot!

0 Karma

swetvenk
New Member

Hi Folks..

I have a similar requirement wherein I want the name of the lookup file to be print against the data from each of them in the following way. For some reason, the eval function is not giving the desired output. Can anyone help ?

| rest /servicesNS/-/search/data/lookup-table-files splunk_server="local"
| search title="geo_attr*.csv"
| map search="eval lkpnm=$title$ |inputlookup $title$ | stats dc(title) as Count | table lkpnm, Count"

This is giving me the correct count, but not the lookupname!

0 Karma

D2SI
Communicator

Hi @swetvenk, I would do something like this :

| rest /servicesNS/-/search/data/lookup-table-files splunk_server="local" 
| search title="geo_attr*.csv" 
| map search="| makeresults | eval lkpnm=$title$ | append [| inputlookup $title$]| eventstats last(lkpnm) as lkpnm | search NOT _time="*""
| stats count by lkpnm
0 Karma

MikeElliott
Communicator

Have you tried the same with | outputlookup append=true <> ?

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...