Inputlookup subsearch

[msachdeva3]

I have a csv file with some stats code, i have added as a lookup .

I want to use two fields in stats code with say field1=yes and field2=
field2 i there in index but with a different name. I want to restrict search using limited values of field2 in inputlookup in main splunk index sourcetype

I'm not sure if i have write syntax or I'm unable to use inputlookup

index = f sourcetype = bar dedup [|inputlookup statscode.csv | serch field1="Yes" AND fields2 =]
???

I'm not really sure how to for formulate subsearch??
when do I close brackets []

trying to read arcticles but not close to complete a task...

any good respurce to learn inputlookups

[niketn]

Lookup files serve as a table with foreign key which can be joined via Splunk search over a particular index. Like any relational DB joins you will have to ensure that the field name from SPL Search matches that present in the lookup table (you can easily perform this by eval or rename).

For example if you have lookup file added statscode.csv and you created a lookup field statscode, you can try the following:

1) Run following to see content of lookup file(also ensure that it is correct and accessible)

|inputlookup statscode

2) Run the Splunk search on index (assuming field1 and field3 are the fields from index being searched). Rename field3 as field2 (assuming field2 is present in lookup table) and join to lookup table statscode field2 through lookup command.

index="foo" sourcetype="bar" field1="Yes"| eval field2=field3 | lookup statscode field2 | table field1, field2, field3 ....

Splunk Search reference will be a good place to read and try out some examples:
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Lookup

Geostats table example in Splunk 6.x Dashboard Examples app also uses a lookup table to map States to their geocoodinates (present in the lookup table).

[hunters_splunk]

Thanks for your question, masachdeva3,

I'm not sure the exact query you want to run in your .csv file, but this is the correct syntax of inputlookup:

| inputlookup [append=] [start=] [max=] [ | ] [WHERE ]

Please refer to the detailed usage instructions here:
http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Inputlookup

Hope it helps. Thanks!
Hunter