Splunk Search

Is there a way to view the contents of saved csv on a lookup table from Splunk Web?

kuga_mbsd
New Member

hi there,
I am still new to Splunk.
There are some csv saved on lookup table, but I don't have admin access to the Splunk Linux host, so unable to take a look.
Is there anyway from splunk web?

Tags (3)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi kuga_mbsd,

you can try the commands inputcsv http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Inputcsv or inputlookup http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Inputlookup and see what you get back from it.

Be aware, that you either need to know the file name for inputcsv or the lookup definition name for inputlookup and not to forget you need to have at least read access to the files.

Hope that helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi kuga_mbsd,

you can try the commands inputcsv http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Inputcsv or inputlookup http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Inputlookup and see what you get back from it.

Be aware, that you either need to know the file name for inputcsv or the lookup definition name for inputlookup and not to forget you need to have at least read access to the files.

Hope that helps ...

cheers, MuS

kuga_mbsd
New Member

Thank you, MuS,

I tried inputcsv, but the csv file is not located under $SPLUNK_HOME/var/run and got error "/opt/splunk/var/run/ACUTUAL/PATH/I/ENTER/AAA.csv"...

how can I specify the file path?

0 Karma

Arun_N_007
Communicator

Hi,

|inputlookup will work only when it is present in the lookups folder of an app. It also depends on the permissions. If lookup is private it will be readable by that specific user. Check its properties and permissions in Lookups section in Splunk Web.

kuga_mbsd
New Member

Thank you, both MuS and Arun_N_007.

inputlookup just works!
It just took too long since csv has almost 100K lines, so I thought it wasn't working.

Thanks again.

0 Karma

MuS
SplunkTrust
SplunkTrust

This is not possible with inputcsv, it only allows to read cvs files in $SPLUNK_HOME/var/run/splunk

Did you try inputlookup already?

Get Updates on the Splunk Community!

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...