Is it possible to run two separate searches on a Inputlookup CSV to use the first/last X amount of results?

[UMDTERPS]

I am looking to run two searches on a CSV, one that looks at the first 35,000 results and another that looks at the last 35,000 results. The easiest way to solve the problem would be to increase the subsearch limit to 100,000, however, the admin is refusing to do so. Another way would be to chop the CSV in half and run the same search twice.

Is there a command or search in Splunk that can look at the first 35,000 results and another that looks at the last 35,000 results of a lookup?

Would using head and tail be the best way? (however, the total results may change every day/week)

Thanks!

[richgalloway]

Totally untested, but you might try this.

| multisearch [|inputlookup something.csv | head 35000] [|inputlookup something.csv | tail 35000] | ...

[UMDTERPS]

I think the union command can be used too?:

| union maxout=10000000
[ search index=union_1 | head 60000]
[ search index=union_1 | tail 40000]

https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Union

[UMDTERPS · Accepted solution]

Okay, figured it out:

|inputlookup ip_dump.csv 
| streamstats count("IP Address") as row_number
| where row_number <= 50000
| append [
    |inputlookup ip_dump.csv 
    | streamstats count("IP Address") as row_number
    | where row_number > 50000]

[somesoni2]

Give this workaroud a try (single search with no subsearch)

| inputlookup yourlookup.csv 
| streamstats count as fwd_sno
| reverse 
| streamstats count as rev_sno
| reverse
| where fwd_sno<=35000 OR rev_sno<=35000

Basically adding two serial number columns, one in up to down and second down to up. Then selecting first 35000 rows in either serial number.

[UMDTERPS]

I think this would work too! =0)

Thanks!