Splunk Search

What are we doing wrong in our Splunk API request for inputlookup?

jnichols914
Explorer

Hi Everyone, we have another internal team that is trying to use the API to return some data we built for them. Unfortunately, they aren't able to get the payload but only the headers. Can someone suggest a solution or what we are doing wrong? the below is the response from the splunk API on their call.

 

Target: https://SomeHost:Port/servicesNS/user/search/search/jobs/export 

Request body:

 

 

 

 

search=search inputlookup somefile.csv | table Day User emp_id Data

 

 

 

 

 

Response:

 

 

 

 

<results preview='0'>
<meta>
<fieldOrder>
<field>Day</field>
<field>User</field>
<field>emp_id</field>
<field>Data</field>
</fieldOrder>
</meta>
</results>

 

 

 

 

 

 

Labels (1)
0 Karma
1 Solution

jnichols914
Explorer

@PickleRick , thanks for leading us down the path. We actually had to append to get the data. What worked was the code below. Thank you for getting us there.

search=search NOT * | inputlookup somefile.csv append=true | table Day User emp_id Data

View solution in original post

0 Karma

jnichols914
Explorer

@PickleRick , thanks for leading us down the path. We actually had to append to get the data. What worked was the code below. Thank you for getting us there.

search=search NOT * | inputlookup somefile.csv append=true | table Day User emp_id Data
0 Karma

jnichols914
Explorer

Thanks Rick. We will give this a shot and let you know the results. Appreciate you helping.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

It's not entirely clear what you're trying to achieve.

The search

search=search inputlookup somefile.csv

will try to find events which contain literarily "inputtlookup" and "somefile.csv" strings in them (and of course field named search with value "search" but that's most probably a placeholder for some other part of a search).

So your initial search matches no results and the table command has no data to process so you only get column headers.

If you want the contents of a lookup, you need an inputlookup command on its own:

| inputlookup somefile.csv | table your set of fields

If you want the lookup to be applied to results of a search, just use lookup command

your search | lookup somefile.csv field | table [...]

If you want to append the results of the inputlookup command to the results of a search, just use inputlookup with append=true option

your search | inputlookup append=true somefile.csv | table [...]
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...