How to use a Lookup table or an Imported CSV file to perform a search

[andres91302]

Hello Everyone and welcome

is there a way to import a csv file to then use it a search parameter to search for events within an index in splunk? I am trying to  find the total bill cost of some patients in a hospital but I am only interested in some IDs I have in a CSV file I use this code to find total bill amount

index="rea_host"
search ID=* AND bill_due=*
| stats values(bill_due) by ID

I am trying to use a CVS file named "STATUS" where the ID fields has the name "patient_documentation"

I type:

index="rea_host"
search bill_due=* AND [  lookup  STATUS OUTPUT patient_documentation as ID]
| stats values(bill_due) by ID

with no luck, can someone please help me out? thank you so much

[kamlesh_vaghela · Accepted solution]

@andres91302 

Did you tried this?

index="rea_host" bill_due=* [ | inputlookup STATUS OUTPUT patient_documentation as ID | table ID]
| stats values(bill_due) by ID

Thanks
KV
▄︻̷̿┻̿═━一

If this reply helps you, an upvote would be appreciated.