Splunk Search

How to extract filename from inputlookup csv file with query

bimatomsoc
Explorer

I want to get my inputlookup csv filename with the query.

| inputlookup abc.csv
| stats count by inputlookup_filename  ```<= the result I needed is "abc"```
Or
| table inputlookup_filename ```<= the result I needed is "abc"```

Labels (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust
Can you describe what and why you want? Currently I haven’t any hints how and where you would like to get it 😞
Usually you could should use sub query to add it, but we should know what you are looking.

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

you get filename with rest e.g.

| rest /services/data/lookup-table-files search="abc.csv" 
| fields title eai:appName eai:data

r. Ismo 

bimatomsoc
Explorer

Thanks for your response. It's really helpful and knowledgeable. Your rest query can get the lookupfilename as title.

Actually, my original search query is -

| inputlookup abc.csv | rename field1 as new_field
| append [| inputlookup def.csv | rename field1 as new_field]
| table new_field

 

When I put rest query that you provided, "rest" must be the first place in search.
I do want to know how to combine my original query and rest query to get the new_field and lookupfilename.

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Can you describe what and why you want? Currently I haven’t any hints how and where you would like to get it 😞
Usually you could should use sub query to add it, but we should know what you are looking.

bimatomsoc
Explorer

Thank you very much, Sir. Finally, I got the solution based on your suggestion. I put the filename column and value in the csv file. That is the easy way to get the lookupfilename in search. 

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...