Splunk Search

Table command does not display field with spaces when used with INPUTLOOKUP

neerajs_81
Builder

Hello All,
I have a search query that performs lookups against a CSV file and outputs only those hosts that are in the CSV file.
The CSV file has the following 4 columns and notice the IP Address column has a white space in it.
neerajs_81_0-1632911646690.png

I have verified the following command displays the values correctly of all hosts with their IP in a table

 

 

 

| inputlookup linux_servers.csv | table host "IP Address"

 

 

 

Now, if put the same thing  in a  tstats command, it does not show any results.  Any ideas why does it not take "IP Address" even though i have stated double quotes ?? 

 

 

 

| tstats max(_time) as lastSeen_epoch WHERE index=linux [| inputlookup linux_servers.csv |  table host "IP Address" ] by host

 

 

 

The following search works fine , if i take out the "IP Address" . It displays the table with host column.

 

 

 

| tstats max(_time) as lastSeen_epoch WHERE index=linux [| inputlookup linux_servers.csv |  table host ] by host

 

 

 

 

Labels (2)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

When troubleshooting a query containing a subsearch, it helps to run the subsearch by itself with the | format command appended.  This will show exactly what is added to the main search.

| inputlookup linux_servers.csv |  table host "IP Address" | format

You'll find the main search ends up looking something like this

| tstats max(_time) as lastSeen_epoch WHERE index=linux ((host=foo AND "IP Address"=1.1.1.1) OR (host=bar AND "IP Address"=1.2.3.4)) by host

Make sure that final query string makes sense with your data.

What you're more likely running into, however, is one of the fields in the tstats command is not indexed and so it is not found.  The "IP Address" field is the most likely candidate.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

When troubleshooting a query containing a subsearch, it helps to run the subsearch by itself with the | format command appended.  This will show exactly what is added to the main search.

| inputlookup linux_servers.csv |  table host "IP Address" | format

You'll find the main search ends up looking something like this

| tstats max(_time) as lastSeen_epoch WHERE index=linux ((host=foo AND "IP Address"=1.1.1.1) OR (host=bar AND "IP Address"=1.2.3.4)) by host

Make sure that final query string makes sense with your data.

What you're more likely running into, however, is one of the fields in the tstats command is not indexed and so it is not found.  The "IP Address" field is the most likely candidate.

---
If this reply helps you, Karma would be appreciated.

neerajs_81
Builder

You are right.  Very basic mistake to forget that "IP Address" field is not indexed .  Tstats would never find this field.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...