Splunk Search

How to extract filename from inputlookup csv file with query

bimatomsoc
Explorer

I want to get my inputlookup csv filename with the query.

| inputlookup abc.csv
| stats count by inputlookup_filename  ```<= the result I needed is "abc"```
Or
| table inputlookup_filename ```<= the result I needed is "abc"```

Labels (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust
Can you describe what and why you want? Currently I haven’t any hints how and where you would like to get it 😞
Usually you could should use sub query to add it, but we should know what you are looking.

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

you get filename with rest e.g.

| rest /services/data/lookup-table-files search="abc.csv" 
| fields title eai:appName eai:data

r. Ismo 

bimatomsoc
Explorer

Thanks for your response. It's really helpful and knowledgeable. Your rest query can get the lookupfilename as title.

Actually, my original search query is -

| inputlookup abc.csv | rename field1 as new_field
| append [| inputlookup def.csv | rename field1 as new_field]
| table new_field

 

When I put rest query that you provided, "rest" must be the first place in search.
I do want to know how to combine my original query and rest query to get the new_field and lookupfilename.

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Can you describe what and why you want? Currently I haven’t any hints how and where you would like to get it 😞
Usually you could should use sub query to add it, but we should know what you are looking.

bimatomsoc
Explorer

Thank you very much, Sir. Finally, I got the solution based on your suggestion. I put the filename column and value in the csv file. That is the easy way to get the lookupfilename in search. 

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...