Is there a way to search across multiple lookup files to find text within them?

[finchy]

Hi

Is there a way to search across multiple Lookup files to find text within them ?  I know that you can use | inputlookup to get the contents of a single lookup csv file but I'm trying to search for any csv files that might have a specific string value.

[scelikok]

@finchy,

You can use below sample, it will search for  "text_to_search" value in all lookups. It is better to limit lookup files by filtering title.

| rest /servicesNS/-/-/data/lookup-table-files f=title 
| fields title 
| dedup title 
| map maxsearches=1000 search="|inputlookup $title$  | fieldsummary |eval lookup_name=$title$ | fields values field lookup_name " 
| spath input=values 
| rename {}.* as *| fields lookup_name field value 
| search value="text_to_search"

[finchy]

Hi,

Thanks i get this error message and only returns a few records guess i don't have enough permissions

Restricting results of the "rest" operator to the local instance because you do not have the "dispatch_rest_to_indexers" capability

[richgalloway]

There's no need to grab lookup files from the indexers since the SH should have the same ones.  Use the splunk_server=local option to suppress the warning.

| rest splunk_server=local /servicesNS/-/-/data/lookup-table-files f=title 
| fields title 
| dedup title 
| map maxsearches=1000 search="|inputlookup $title$  | fieldsummary |eval lookup_name=$title$ | fields values field lookup_name " 
| spath input=values 
| rename {}.* as *| fields lookup_name field value 
| search value="text_to_search"

[richgalloway]

Searching multiple lookup files requires using multiple lookup commands, one for each file.