How to query a lookup table using the REST API?

[raduand]

Hi guys,

I have a Splunk scheduled search which is producing a list of URLs that need to be used by another system. The other system has to access the list using http/https protocol.

Now, what i'm looking for is:

• making the search results (csv file) available through something like https://splunkserver/list.csv
• appending the search results to a lookup table and querying the lookup table using something like https://splunkserver:8089/servicesNS/admin/search/data/lookup-table-files/list.csv

Can someone guide me in how to achieve this?

Thanks in advance!
Andrei

[jkat54]

 search="| inputlookup lookupname.csv"

[niketn · Accepted solution]

@raduand, Splunk search results can be pushed to lookup file using outputlookup. (Refer to documentation: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Outputlookup)

Within Splunk you can read csv file using inpulookup command. ( Refer to documentation: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/inputlookup)

You can create report with inputlookup command to list the contents of the csv file and the pull the Report results using REST API search/jobs/{search_id}/results. Refer to documentation: http://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTsearch#search.2Fjobs.2F.7Bsearch_id.7...

[hettervik]

This is great, but is there any way of finding the "search_id" of a scheduled search? I've tried using the search_id that is listed in the URL when opening the search in the GUI and the search_is that is listed on the enpoint https://<host>:<mPort>/services/search/jobs (which I found to be not the same for some reason), but I always get the result "Unknown endpoint".

Anyone know how to find the correct ID for a scheduled search?

[rhirasin]

Thanks  lot @niketn ,

you solution work perfectly,

we really miss you... 😞