How to use INPUTLOOKUP command in splunk

[abhayneilam]

Hi ,

I am new to splunk, I want to seach multiple keywords from a list ( .txt ) , I would like to know how it could be done using "inputlookup" command ..

Please help !!

Thanks
Abhay

[_d_ · Accepted solution]

Assume you define a lookup table as described here: http://docs.splunk.com/Documentation/Splunk/5.0/Knowledge/Addfieldsfromexternaldatasources

Further, assume that the lookup is called foo and its associated file looks as such:

status, category
200, good
400, bad
500, worse

1.You can use the following search that utilizes the inputlookup command to search on status=values:

"index=my_index [| inputlookup foo | return 10 status]"

which translates to :

"index=my_index (status="200") OR (status="400") OR (status="500")"

2.To search ONLY on status values:

index=my_index [| inputlookup foo | return 10 $status]

which translates to:

index=my_index (200) OR (400) OR (500)

Hope this helps,

d.

[SubtotalAMG]

• Hi, I still don't understand the difference between $<field> and <fields>. Can you ELI5?

[vijaysubramania]

Hi, If i want to count the no of responseStatus, how do you achieve that.

For exaple I want to update the file with No of 200, 201, 203, 204, every 10 mins.

I want to use this data in future to plot my Charts

[soumyasaha25]

I have a requirement that is somewhat similar:
i have a list of query strings (these are just strings not a field)
(eg. Too many open files, CPU Starvation detected, java.sql.SQLException: Cannot obtain connection, thread(s) in total in the server that may be hung, Trust Association Init Error, problems occurred during startup for, OutOfMemoryError)
My requirement is to save these strings in a field and then run a query like
index=abc sourcetype=xyz "field_name" |stats count by field_name
I have already saved these queries in a lookup csv, but unable to reference the lookup file to run the query

my intention is to create a logic to use the lookup file so that in a rare event if there are any changes/addition/deletion to the query strings, no one touches the actual query, just a change/addition/deletion in the lookup file would be enough.

when i run |inputlookup search_string.csv | return 15 $search_string
i get the output as
(Too many open files) OR (CPU Starvation detected) OR (java.sql.SQLException: Cannot obtain connection:) OR (thread(s) in total in the server that may be hung)
how do i write a query so that it searches all the strings individually and later when i do a stats gives me a occurance count of each string.

[gjanders]

Please open a new question for the above, commenting on the existing one is unlikely to obtain an appropriate answer.

[rashid47010]

where should we copy that file

[jeff]

Following the example above:

index=my_index [| inputlookup foo | return 10 status] | stats count by status

Should get you what you want.

[abhayneilam]

But if I want to output, the no. of occurence for each Status code : like

Status_Code Count
200 5
300 2
400 10
500 1
600 30

Please help me regarding this

[ChrisG]

The lookup file must be .csv or .csv.gz. There are some brief examples in the Search Reference.

[theouhuios]

Splunk in general will need a .csv or a tarred version of .csv file to be used. So AFAIK it won't read data from .txt file.

[abhayneilam]

ok. even if it reads from .csv , can u please give me one example how it can be used.

Please help