Splunk Search

| input lookup return ALL rather than specify number

robf
Path Finder

I'm trying to add this to my search but the number of lookup users may change!!

(|inputlookup lotsofusers.csv | return 3 $users)

((user1) OR (user2) OR (user3))

Is there a better way to do this? * does not work.

Thanks

Tags (2)

orion44
Communicator

It would be nice to know the answer to this question. Why do we have to specify a hardcoded value of records to return when using inputlookup? The logical thing to do is check all records.

0 Karma

somesoni2
Revered Legend

Give this a try

your base search  [|inputlookup lotsofusers.csv | eval search=users | table search]
0 Karma

aweitzman
Motivator

If you're using it as a subsearch, you can use the fields command to reduce what gets returned without needing return. Try this:

[|inputlookup lotsofusers.csv | fields users]

You should get all of them.

0 Karma

robf
Path Finder

thanks but this gives

((user=user1) OR (user=user2) OR (user=user3))

i want to search keywords only

((user1) OR (user2) OR (user3))

with the return command you can use the $ symbol to achieve this

0 Karma

aweitzman
Motivator

How about this:

[|inputlookup lotsofusers.csv | fields users | format | rex field=search mode=sed "s/user=//g"]

0 Karma

fdi01
Motivator

try as:
[|inputlookup lotsofusers.csv | return 3 $users]

0 Karma

robf
Path Finder

i dont think you understood the question... i don't want to specify how many users. it could be 3 , 300, 3333...

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!