What are the differences between the lookup and inputlookup commands?

[sel105]

Is there any reason why this command would work:

| inputlookup myfile | search SERIAL_NO "1234" | table X, Y, Z

And this command would work:

index=mydata serial_number="1234" | table subject

But this command would not work:

index=mydata serial_number="1234" | lookup myfile SERIAL_NO as serial_number output X, Y, Z | table subject, X, Y, Z

And by "not work", I mean that the table command produces a result with "subject," but no X, Y, or Z..... the lookup is failing.

[jplumsdaine22]

Does this command work? | inputlookup myfile | search SERIAL_NO="1234" | table X, Y, Z (note the = between SERIAL_NO and 1234) it may be that the fields are not correctly configured, thus lookup myfile SERIAL_NO as serial_number output X, Y, Z returns no values.

The inputlookup command you use may be matching the string "1234" rather than the field SERIAL_NO, which is why it works.

[sel105]

Thanks! But yes, that command works. WE think we've figured out the problem which is that the file reached over 10MB in size, so splunk indexed/cached it. then, when we uploaded a new file (one that has 1234 in it), splunk is still using the old cached version. does anyone know where i can delete the tsidx file of the cached version?

[jplumsdaine22]

I don't know sorry. Hopefully someone else can help.

[sel105]

also probably worth noting that for, let's say, serial number 3333....which was in one of the previous versions of this lookup file, and is also in the newer version...... this command works fine. is the lookup file cached somewhere that only gets looked at when "|lookup" is run, but not when "|inputlookup" is run?

[sel105]

It might be important to note that this lookup file is one that we have to delete and replace monthly. we can't append because the data changes so much every month.