Splunk Search

How to make inputlookup return function check all records (rows) in a CSV?

orion44
Communicator

Currently the inputlookup return function requires you to input a hardcoded total of records to check when used in a subsearch. Why is this required and how do you make it return all records?

Example usage:

index=logs [| inputlookup data.csv | return 1000 name=$hostname]

I have to hard code the "1000" to tell Splunk to check 100 records in the lookup. This requirement is illogical as I always want it to check (lookup) ALL records. As a workaround, I just pick a high number that exceeds the total rows in the CSV.

0 Karma
1 Solution

niketn
Legend

@orion44 try the following

Using the table command in the sub-search:

index=logs 
    [| inputlookup data.csv 
    | fields hostname 
    | rename hostname as name 
    | table name ]

Or using the format command

index=logs 
    [| inputlookup data.csv 
   | fields hostname
   | rename hostname as name
   | format]
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@orion44 try the following

Using the table command in the sub-search:

index=logs 
    [| inputlookup data.csv 
    | fields hostname 
    | rename hostname as name 
    | table name ]

Or using the format command

index=logs 
    [| inputlookup data.csv 
   | fields hostname
   | rename hostname as name
   | format]
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

orion44
Communicator

Works perfectly, thanks!

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...