Splunk Search

How to take output from a lookup and feed it to another lookup and append the results?

Glasses
Builder

Hi,

Let's say I have a Company directory lookup (e.g. Company_Directory) and I want to lookup the entire hierarchy of supervisors for a specific employee.

For instance>>>

Alice reports to Bob, then take Bob as new lookup criteria...

Bob reports to Cathy, etc....  

and append this all  in a chain of command >>> Alice, Bob, Cathy, Donna, Eric, Fred.... etc

Does Splunk have a command/capability to take the results as feed back to a lookup loop?

Thank you

Labels (1)
0 Karma
1 Solution

PickleRick
Ultra Champion

SPL is not an imperative programming language so apart from some exceptions like foreach it doesn't understand concepts of "loop" and such.

Also, even though you may perform an inputlookup, modify it and outputlookup it at the end, it will only update the contents of the lookup. That lookup won't be processed back again by the same search pipeline. It might get processed by subsequent run (for example if it's a scheduled report).

 

View solution in original post

0 Karma

PickleRick
Ultra Champion

SPL is not an imperative programming language so apart from some exceptions like foreach it doesn't understand concepts of "loop" and such.

Also, even though you may perform an inputlookup, modify it and outputlookup it at the end, it will only update the contents of the lookup. That lookup won't be processed back again by the same search pipeline. It might get processed by subsequent run (for example if it's a scheduled report).

 

0 Karma

Glasses
Builder

Thanks, I didn't really think it was possible to do a loop, but had to ask... 

0 Karma

PickleRick
Ultra Champion

There are tricks to do a bit of imperative-like programming (there was a presentation on it on one of previous .confs) but it's more of a proof-of-concept that it's possible - it's not very practical, not very readable and not very efficient. And of course scope of usability is very very limited.

So it's safe to assume that you can't do such things in general.

0 Karma
Get Updates on the Splunk Community!

How to use Timechart Query

Hey guys ,I need last 30 days stats for the use-cases that did not fire up on the ES console. Below is the ...

Advisory ID: SVD-2022-0608

Hi,Security alert: Splunk Universal Forwarder.Is this a customer installable upgrade (to version 9), or do I ...

Checksum mismatch on Deployment Clients which were rebuilt with same IP but different ...

We recently rebuilt a server which had splunk UF installed. After the rebuild, the IP remained same but ...