Splunk Search

What does format do after a table lookup

OldManEd
Builder

I inherited a search that contains he following line;

[| inputlookup <lookup table name> | format ]

and I can't figure out what it does. The table contains one column with a title of my_field. The data is numbers and subnet addresses, (Like 1.2.3.4/24). Now there is a field from the raw event called my_field, but I can't figure out how everything works together.

After the line there is the ~stats~ portion of the search that summarizes the data and my_field is mentioned like below;

| stats sum(field_b) by my_field

but I'm not sure what the lookup does for me. I guess I'm trying to understand what the inputlookup format above does. I can't really find anything in the docs.

0 Karma
1 Solution

elliotproebstel
Champion

Based on your description of the search, I suspect the search is structured to use the data in the lookup file as a search filter, which will narrow the results of the base search to only events containing my_field values that are present in the lookup file.

As @mayurr98 pointed out, the format command itself isn't really doing much in the context of this search, because it's used implicitly in subsearches anyway.

If I'm correct about the intention of the user who wrote the search, it's probably structured like this:

index=something sourcetype=whatever 
[| inputlookup <lookup table> 
 | format ] 
| stats sum(field_b) by my_field

View solution in original post

0 Karma

elliotproebstel
Champion

Based on your description of the search, I suspect the search is structured to use the data in the lookup file as a search filter, which will narrow the results of the base search to only events containing my_field values that are present in the lookup file.

As @mayurr98 pointed out, the format command itself isn't really doing much in the context of this search, because it's used implicitly in subsearches anyway.

If I'm correct about the intention of the user who wrote the search, it's probably structured like this:

index=something sourcetype=whatever 
[| inputlookup <lookup table> 
 | format ] 
| stats sum(field_b) by my_field
0 Karma

OldManEd
Builder

Thanks. It makes a lot more sense now.

0 Karma

mayurr98
Super Champion

FORMAT- This command is used implicitly by subsearches. This command takes the results of a subsearch, formats the results into a single result and places that result into a new field called search.
Refer this doc for more info.
https://docs.splunk.com/Documentation/Splunk/7.0.3/SearchReference/Format
You can run | inputlookup <lookup table name> | format seperately to see what you get in search field and then you may try to understand query.

let me know if this helps!

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...