hi there,
I am still new to Splunk.
There are some csv saved on lookup table, but I don't have admin access to the Splunk Linux host, so unable to take a look.
Is there anyway from splunk web?
Hi kuga_mbsd,
you can try the commands inputcsv
http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Inputcsv or inputlookup
http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Inputlookup and see what you get back from it.
Be aware, that you either need to know the file name for inputcsv
or the lookup definition name for inputlookup
and not to forget you need to have at least read access to the files.
Hope that helps ...
cheers, MuS
Hi kuga_mbsd,
you can try the commands inputcsv
http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Inputcsv or inputlookup
http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Inputlookup and see what you get back from it.
Be aware, that you either need to know the file name for inputcsv
or the lookup definition name for inputlookup
and not to forget you need to have at least read access to the files.
Hope that helps ...
cheers, MuS
Thank you, MuS,
I tried inputcsv, but the csv file is not located under $SPLUNK_HOME/var/run and got error "/opt/splunk/var/run/ACUTUAL/PATH/I/ENTER/AAA.csv"...
how can I specify the file path?
Hi,
|inputlookup will work only when it is present in the lookups folder of an app. It also depends on the permissions. If lookup is private it will be readable by that specific user. Check its properties and permissions in Lookups section in Splunk Web.
Thank you, both MuS and Arun_N_007.
inputlookup just works!
It just took too long since csv has almost 100K lines, so I thought it wasn't working.
Thanks again.
This is not possible with inputcsv, it only allows to read cvs files in $SPLUNK_HOME/var/run/splunk
Did you try inputlookup already?