Splunk Search

Is there a way to view the contents of saved csv on a lookup table from Splunk Web?

New Member

hi there,
I am still new to Splunk.
There are some csv saved on lookup table, but I don't have admin access to the Splunk Linux host, so unable to take a look.
Is there anyway from splunk web?

Tags (3)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Hi kuga_mbsd,

you can try the commands inputcsv http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Inputcsv or inputlookup http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Inputlookup and see what you get back from it.

Be aware, that you either need to know the file name for inputcsv or the lookup definition name for inputlookup and not to forget you need to have at least read access to the files.

Hope that helps ...

cheers, MuS

View solution in original post

SplunkTrust
SplunkTrust

Hi kuga_mbsd,

you can try the commands inputcsv http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Inputcsv or inputlookup http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Inputlookup and see what you get back from it.

Be aware, that you either need to know the file name for inputcsv or the lookup definition name for inputlookup and not to forget you need to have at least read access to the files.

Hope that helps ...

cheers, MuS

View solution in original post

New Member

Thank you, MuS,

I tried inputcsv, but the csv file is not located under $SPLUNK_HOME/var/run and got error "/opt/splunk/var/run/ACUTUAL/PATH/I/ENTER/AAA.csv"...

how can I specify the file path?

0 Karma

Communicator

Hi,

|inputlookup will work only when it is present in the lookups folder of an app. It also depends on the permissions. If lookup is private it will be readable by that specific user. Check its properties and permissions in Lookups section in Splunk Web.

New Member

Thank you, both MuS and Arun_N_007.

inputlookup just works!
It just took too long since csv has almost 100K lines, so I thought it wasn't working.

Thanks again.

0 Karma

SplunkTrust
SplunkTrust

This is not possible with inputcsv, it only allows to read cvs files in $SPLUNK_HOME/var/run/splunk

Did you try inputlookup already?

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!