Splunk Search

How to extract filename from inputlookup csv file with query

bimatomsoc
Explorer

I want to get my inputlookup csv filename with the query.

| inputlookup abc.csv
| stats count by inputlookup_filename  ```<= the result I needed is "abc"```
Or
| table inputlookup_filename ```<= the result I needed is "abc"```

Labels (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust
Can you describe what and why you want? Currently I haven’t any hints how and where you would like to get it 😞
Usually you could should use sub query to add it, but we should know what you are looking.

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

you get filename with rest e.g.

| rest /services/data/lookup-table-files search="abc.csv" 
| fields title eai:appName eai:data

r. Ismo 

bimatomsoc
Explorer

Thanks for your response. It's really helpful and knowledgeable. Your rest query can get the lookupfilename as title.

Actually, my original search query is -

| inputlookup abc.csv | rename field1 as new_field
| append [| inputlookup def.csv | rename field1 as new_field]
| table new_field

 

When I put rest query that you provided, "rest" must be the first place in search.
I do want to know how to combine my original query and rest query to get the new_field and lookupfilename.

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Can you describe what and why you want? Currently I haven’t any hints how and where you would like to get it 😞
Usually you could should use sub query to add it, but we should know what you are looking.

bimatomsoc
Explorer

Thank you very much, Sir. Finally, I got the solution based on your suggestion. I put the filename column and value in the csv file. That is the easy way to get the lookupfilename in search. 

0 Karma
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...