Splunk Search

How to make inputlookup return function check all records (rows) in a CSV?

orion44
Communicator

Currently the inputlookup return function requires you to input a hardcoded total of records to check when used in a subsearch. Why is this required and how do you make it return all records?

Example usage:

index=logs [| inputlookup data.csv | return 1000 name=$hostname]

I have to hard code the "1000" to tell Splunk to check 100 records in the lookup. This requirement is illogical as I always want it to check (lookup) ALL records. As a workaround, I just pick a high number that exceeds the total rows in the CSV.

0 Karma
1 Solution

niketn
Legend

@orion44 try the following

Using the table command in the sub-search:

index=logs 
    [| inputlookup data.csv 
    | fields hostname 
    | rename hostname as name 
    | table name ]

Or using the format command

index=logs 
    [| inputlookup data.csv 
   | fields hostname
   | rename hostname as name
   | format]
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@orion44 try the following

Using the table command in the sub-search:

index=logs 
    [| inputlookup data.csv 
    | fields hostname 
    | rename hostname as name 
    | table name ]

Or using the format command

index=logs 
    [| inputlookup data.csv 
   | fields hostname
   | rename hostname as name
   | format]
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

orion44
Communicator

Works perfectly, thanks!

Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...