What are we doing wrong in our Splunk API request for inputlookup?

[jnichols914]

Hi Everyone, we have another internal team that is trying to use the API to return some data we built for them. Unfortunately, they aren't able to get the payload but only the headers. Can someone suggest a solution or what we are doing wrong? the below is the response from the splunk API on their call.

Target: https://SomeHost:Port/servicesNS/user/search/search/jobs/export 

Request body:

search=search inputlookup somefile.csv | table Day User emp_id Data

Response:

<results preview='0'>
<meta>
<fieldOrder>
<field>Day</field>
<field>User</field>
<field>emp_id</field>
<field>Data</field>
</fieldOrder>
</meta>
</results>

[jnichols914 · Accepted solution]

@PickleRick , thanks for leading us down the path. We actually had to append to get the data. What worked was the code below. Thank you for getting us there.

search=search NOT * | inputlookup somefile.csv append=true | table Day User emp_id Data

[jnichols914]

Thanks Rick. We will give this a shot and let you know the results. Appreciate you helping.

[PickleRick]

It's not entirely clear what you're trying to achieve.

The search

search=search inputlookup somefile.csv

will try to find events which contain literarily "inputtlookup" and "somefile.csv" strings in them (and of course field named search with value "search" but that's most probably a placeholder for some other part of a search).

So your initial search matches no results and the table command has no data to process so you only get column headers.

If you want the contents of a lookup, you need an inputlookup command on its own:

| inputlookup somefile.csv | table your set of fields

If you want the lookup to be applied to results of a search, just use lookup command

your search | lookup somefile.csv field | table [...]

If you want to append the results of the inputlookup command to the results of a search, just use inputlookup with append=true option

your search | inputlookup append=true somefile.csv | table [...]