Splunk Search

How to make inputlookup return function check all records (rows) in a CSV?

orion44
Communicator

Currently the inputlookup return function requires you to input a hardcoded total of records to check when used in a subsearch. Why is this required and how do you make it return all records?

Example usage:

index=logs [| inputlookup data.csv | return 1000 name=$hostname]

I have to hard code the "1000" to tell Splunk to check 100 records in the lookup. This requirement is illogical as I always want it to check (lookup) ALL records. As a workaround, I just pick a high number that exceeds the total rows in the CSV.

0 Karma
1 Solution

niketn
Legend

@orion44 try the following

Using the table command in the sub-search:

index=logs 
    [| inputlookup data.csv 
    | fields hostname 
    | rename hostname as name 
    | table name ]

Or using the format command

index=logs 
    [| inputlookup data.csv 
   | fields hostname
   | rename hostname as name
   | format]
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@orion44 try the following

Using the table command in the sub-search:

index=logs 
    [| inputlookup data.csv 
    | fields hostname 
    | rename hostname as name 
    | table name ]

Or using the format command

index=logs 
    [| inputlookup data.csv 
   | fields hostname
   | rename hostname as name
   | format]
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

orion44
Communicator

Works perfectly, thanks!

Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...