Splunk Search

How to use search a CSV lookup file within an App via Python SDK?

BrentRiva
Explorer

I'm working in Python and trying to use the SDK to search from a program. One of the apps I have installed uses a lookup table (CSV file) to add fields to events, and I'm trying to search on those events (specifically, the CSV file in the app adds 'cost_center=____' to the data, and I'm trying to search for a specific call center).

As I don't know how to do this, my searches right now are returning 0 results. Is there a place I can read up on this, or is the answer easy enough to answer here?

Edit: Would namespace=<app_name> work?
Thanks!

0 Karma

BrentRiva
Explorer

Namespace= seems to be working, but I'm getting much less results than normal, though (1 million on the website vs. 260 on the API call). I think this is the answer, but I'll wait until a more definitive answer is posted.

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...