Splunk Search

How to use INPUTLOOKUP command in splunk

abhayneilam
Contributor

Hi ,

I am new to splunk, I want to seach multiple keywords from a list ( .txt ) , I would like to know how it could be done using "inputlookup" command ..

Please help !!

Thanks
Abhay

Tags (2)
0 Karma
1 Solution

_d_
Splunk Employee
Splunk Employee

Assume you define a lookup table as described here: http://docs.splunk.com/Documentation/Splunk/5.0/Knowledge/Addfieldsfromexternaldatasources

Further, assume that the lookup is called foo and its associated file looks as such:

status, category
200, good
400, bad
500, worse

1.You can use the following search that utilizes the inputlookup command to search on status=values:

"index=my_index [| inputlookup foo | return 10 status]"

which translates to :

"index=my_index (status="200") OR (status="400") OR (status="500")"

2.To search ONLY on status values:

index=my_index [| inputlookup foo | return 10 $status]

which translates to:

index=my_index (200) OR (400) OR (500)

Hope this helps,

d.

View solution in original post

_d_
Splunk Employee
Splunk Employee

Assume you define a lookup table as described here: http://docs.splunk.com/Documentation/Splunk/5.0/Knowledge/Addfieldsfromexternaldatasources

Further, assume that the lookup is called foo and its associated file looks as such:

status, category
200, good
400, bad
500, worse

1.You can use the following search that utilizes the inputlookup command to search on status=values:

"index=my_index [| inputlookup foo | return 10 status]"

which translates to :

"index=my_index (status="200") OR (status="400") OR (status="500")"

2.To search ONLY on status values:

index=my_index [| inputlookup foo | return 10 $status]

which translates to:

index=my_index (200) OR (400) OR (500)

Hope this helps,

d.

SubtotalAMG
Loves-to-Learn Lots
  • Hi, I still don't understand the difference between $<field> and <fields>. Can you ELI5?
0 Karma

vijaysubramania
Path Finder

Hi, If i want to count the no of responseStatus, how do you achieve that.

For exaple I want to update the file with No of 200, 201, 203, 204, every 10 mins.

I want to use this data in future to plot my Charts

0 Karma

soumyasaha25
Contributor

I have a requirement that is somewhat similar:
i have a list of query strings (these are just strings not a field)
(eg. Too many open files, CPU Starvation detected, java.sql.SQLException: Cannot obtain connection, thread(s) in total in the server that may be hung, Trust Association Init Error, problems occurred during startup for, OutOfMemoryError)
My requirement is to save these strings in a field and then run a query like
index=abc sourcetype=xyz "field_name" |stats count by field_name
I have already saved these queries in a lookup csv, but unable to reference the lookup file to run the query

my intention is to create a logic to use the lookup file so that in a rare event if there are any changes/addition/deletion to the query strings, no one touches the actual query, just a change/addition/deletion in the lookup file would be enough.

when i run |inputlookup search_string.csv | return 15 $search_string
i get the output as
(Too many open files) OR (CPU Starvation detected) OR (java.sql.SQLException: Cannot obtain connection:) OR (thread(s) in total in the server that may be hung)
how do i write a query so that it searches all the strings individually and later when i do a stats gives me a occurance count of each string.

0 Karma

gjanders
SplunkTrust
SplunkTrust

Please open a new question for the above, commenting on the existing one is unlikely to obtain an appropriate answer.

0 Karma

rashid47010
Communicator

where should we copy that file

0 Karma

jeff
Contributor

Following the example above:

index=my_index [| inputlookup foo | return 10 status] | stats count by status

Should get you what you want.

abhayneilam
Contributor

But if I want to output, the no. of occurence for each Status code : like

Status_Code Count
200 5
300 2
400 10
500 1
600 30

Please help me regarding this

ChrisG
Splunk Employee
Splunk Employee

The lookup file must be .csv or .csv.gz. There are some brief examples in the Search Reference.

theouhuios
Motivator

Splunk in general will need a .csv or a tarred version of .csv file to be used. So AFAIK it won't read data from .txt file.

abhayneilam
Contributor

ok. even if it reads from .csv , can u please give me one example how it can be used.

Please help

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...