Splunk Search

Splunklib API retrieve inputlookup

Tim00
Explorer

Hi all,

have been using the splunklib package in Python to connect to the Splunk API for some time now, and it works fine. As sample search I use is provided below:

searchquery = """search index=wineventlog EventCode=4688 earliest=-4h | fields user, ETC, ETC, ETC
| table user, ETC, ETC, ETC"""
resolveQuery = SplunkQuery(host, port, username, password)
df = resolveQuery.splunk_fetch(searchquery)

The search return a pandas dataframe (in Python) containing the required information.

When I try to retrieve an inputlookup however, the search doesn't return any information, only an empty dataframe.  Below is an example of a searchquery I use to try and retrieve an inputlookup:

searchquery = """search | inputlookup infomation.csv"""

Any help would be highly appreciated: how can I retrieve inputlookups using the Splunklib package in Python?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The inputlookup command is supposed to be the first command in a query.  Try this:

searchquery = """| inputlookup infomation.csv"""

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

Tim00
Explorer

Thanks for your help

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The inputlookup command is supposed to be the first command in a query.  Try this:

searchquery = """| inputlookup infomation.csv"""

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...