Splunk Search

How to extract filename from inputlookup csv file with query

bimatomsoc
Explorer

I want to get my inputlookup csv filename with the query.

| inputlookup abc.csv
| stats count by inputlookup_filename  ```<= the result I needed is "abc"```
Or
| table inputlookup_filename ```<= the result I needed is "abc"```

Labels (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust
Can you describe what and why you want? Currently I haven’t any hints how and where you would like to get it 😞
Usually you could should use sub query to add it, but we should know what you are looking.

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

you get filename with rest e.g.

| rest /services/data/lookup-table-files search="abc.csv" 
| fields title eai:appName eai:data

r. Ismo 

bimatomsoc
Explorer

Thanks for your response. It's really helpful and knowledgeable. Your rest query can get the lookupfilename as title.

Actually, my original search query is -

| inputlookup abc.csv | rename field1 as new_field
| append [| inputlookup def.csv | rename field1 as new_field]
| table new_field

 

When I put rest query that you provided, "rest" must be the first place in search.
I do want to know how to combine my original query and rest query to get the new_field and lookupfilename.

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Can you describe what and why you want? Currently I haven’t any hints how and where you would like to get it 😞
Usually you could should use sub query to add it, but we should know what you are looking.

bimatomsoc
Explorer

Thank you very much, Sir. Finally, I got the solution based on your suggestion. I put the filename column and value in the csv file. That is the easy way to get the lookupfilename in search. 

0 Karma
Get Updates on the Splunk Community!

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...