Splunk Search

Is there a way to view the contents of saved csv on a lookup table from Splunk Web?

kuga_mbsd
New Member

hi there,
I am still new to Splunk.
There are some csv saved on lookup table, but I don't have admin access to the Splunk Linux host, so unable to take a look.
Is there anyway from splunk web?

Tags (3)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi kuga_mbsd,

you can try the commands inputcsv http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Inputcsv or inputlookup http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Inputlookup and see what you get back from it.

Be aware, that you either need to know the file name for inputcsv or the lookup definition name for inputlookup and not to forget you need to have at least read access to the files.

Hope that helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi kuga_mbsd,

you can try the commands inputcsv http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Inputcsv or inputlookup http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Inputlookup and see what you get back from it.

Be aware, that you either need to know the file name for inputcsv or the lookup definition name for inputlookup and not to forget you need to have at least read access to the files.

Hope that helps ...

cheers, MuS

kuga_mbsd
New Member

Thank you, MuS,

I tried inputcsv, but the csv file is not located under $SPLUNK_HOME/var/run and got error "/opt/splunk/var/run/ACUTUAL/PATH/I/ENTER/AAA.csv"...

how can I specify the file path?

0 Karma

Arun_N_007
Communicator

Hi,

|inputlookup will work only when it is present in the lookups folder of an app. It also depends on the permissions. If lookup is private it will be readable by that specific user. Check its properties and permissions in Lookups section in Splunk Web.

kuga_mbsd
New Member

Thank you, both MuS and Arun_N_007.

inputlookup just works!
It just took too long since csv has almost 100K lines, so I thought it wasn't working.

Thanks again.

0 Karma

MuS
SplunkTrust
SplunkTrust

This is not possible with inputcsv, it only allows to read cvs files in $SPLUNK_HOME/var/run/splunk

Did you try inputlookup already?

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...