How to dynamically append the content of multiple lookup files?

[D2SI]

Hello there,

I am trying to dynamically append the content of multiple lookup files but I am not sure it is possible.

Here how I do for now:

| inputlookup geo_attr_countries.csv
| inputlookup append=true geo_attr_us_states.csv

It is working fine but I was wondering if I could build that search without having to explicitly list lookup files.

I can build a search to retrieve the lookups:

| rest /servicesNS/-/search/data/lookup-table-files splunk_server="local"
| search title="geo_attr*.csv"
| fields title

geo_attr_countries.csv
geo_attr_us_states.csv

But I do not see how I can use this to build the search.

I was thinking of something like:

| rest /servicesNS/-/search/data/lookup-table-files splunk_server="local"
| search title="geo_attr*.csv"
| fields title
| foreach title [| inputlookup append=true <<FIELD>>]

But I would get this error:

Error in 'foreach' command: Search pipeline may not contain non-streaming commands.

So I am stuck, any idea on how to achieve this?

Thanks in advance

[HiroshiSatoh · Accepted solution]

You can do this using the map function.

| rest /servicesNS/-/search/data/lookup-table-files splunk_server="local"
| search title="geo_attr*.csv"
| map search="|inputlookup $title$"

[D2SI]

Damn, I did not know about this command, does it perfectly well!

Thanks a lot!

[swetvenk]

Hi Folks..

I have a similar requirement wherein I want the name of the lookup file to be print against the data from each of them in the following way. For some reason, the eval function is not giving the desired output. Can anyone help ?

| rest /servicesNS/-/search/data/lookup-table-files splunk_server="local"
| search title="geo_attr*.csv"
| map search="eval lkpnm=$title$ |inputlookup $title$ | stats dc(title) as Count | table lkpnm, Count"

This is giving me the correct count, but not the lookupname!

[D2SI]

Hi @swetvenk, I would do something like this :

| rest /servicesNS/-/search/data/lookup-table-files splunk_server="local" 
| search title="geo_attr*.csv" 
| map search="| makeresults | eval lkpnm=$title$ | append [| inputlookup $title$]| eventstats last(lkpnm) as lkpnm | search NOT _time="*""
| stats count by lkpnm

[MikeElliott]

Have you tried the same with | outputlookup append=true <> ?