Is there is a way to output the contents of a Lookup file but also show the Lookup file name as results?

[finchy]

Hi Splunkers,

I was wondering if there is a way to output the contents of a Lookup file but also show the Lookup file name as results so for example

| inputlookup append=t <filename1>.csv
| inputlookup append=t <filename2>.csv
| inputlookup append=t <filename3>.csv

Running the above will show the contents but would like to know which file the contents relates to.

Thanks

[batabay]

You can try this ; 

| inputlookup append=true test1.csv 
| eval order = "test1.csv" 
| inputlookup append=true test2.csv 
| eval order = if(isnull(order),"test2.csv",order) 
| inputlookup append=true test3.csv 
| eval order = if(isnull(order),"test3.csv",order)

[finchy]

Thanks.  This helps me out

[gcusello]

Hi @finchy,

let me understand: you want the list of available lookups, is this correct?

if this is your need, you could use a REST API command:

| rest /services/data/lookup-table-files

filtering results using one or more of the available fields.

Ciao.

Giuseppe