Splunk Search

Inputlookup subsearch

msachdeva3
Explorer

I have a csv file with some stats code, i have added as a lookup .

I want to use two fields in stats code with say field1=yes and field2=
field2 i there in index but with a different name. I want to restrict search using limited values of field2 in inputlookup in main splunk index sourcetype

I'm not sure if i have write syntax or I'm unable to use inputlookup

index = f sourcetype = bar dedup [|inputlookup statscode.csv | serch field1="Yes" AND fields2 =]
???

I'm not really sure how to for formulate subsearch??
when do I close brackets []

trying to read arcticles but not close to complete a task...

any good respurce to learn inputlookups

0 Karma

niketn
Legend

Lookup files serve as a table with foreign key which can be joined via Splunk search over a particular index. Like any relational DB joins you will have to ensure that the field name from SPL Search matches that present in the lookup table (you can easily perform this by eval or rename).

For example if you have lookup file added statscode.csv and you created a lookup field statscode, you can try the following:

1) Run following to see content of lookup file(also ensure that it is correct and accessible)

|inputlookup statscode

2) Run the Splunk search on index (assuming field1 and field3 are the fields from index being searched). Rename field3 as field2 (assuming field2 is present in lookup table) and join to lookup table statscode field2 through lookup command.

index="foo" sourcetype="bar" field1="Yes"| eval field2=field3 | lookup statscode field2 | table field1, field2, field3 ....

Splunk Search reference will be a good place to read and try out some examples:
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Lookup

Geostats table example in Splunk 6.x Dashboard Examples app also uses a lookup table to map States to their geocoodinates (present in the lookup table).

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

hunters_splunk
Splunk Employee
Splunk Employee

Thanks for your question, masachdeva3,

I'm not sure the exact query you want to run in your .csv file, but this is the correct syntax of inputlookup:

| inputlookup [append=] [start=] [max=] [ | ] [WHERE ]

Please refer to the detailed usage instructions here:
http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Inputlookup

Hope it helps. Thanks!
Hunter

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...