I have a number of Lookups that I create with similar naming convention (and plan to create more in the future).
I want to be able to have a saved search that searches across all these lookups.
The following does not work as subsearches returned provide a litsearch of (title="chosen_lookups_abcd" OR title="chosen_lookups_bcda" )
|inputlookup append=t [|rest /servicesNS/-/-/data/lookup-table-files | search title=chosen_lookups* | table title ]
Ideally, something like the following would work
| inputlookup append=t chosen_lookups*
Thanks in advance
The inputlookup command reads from a single lookup. There is no provision for reading multiple files at once (via wildcards, for instance). Go to https://ideas.splunk.com to make a case for this enhancement to inputlookup.