Splunk Search

inputlook up query


I have an xls input lookup, I'm trying to find members in inputlook in my source type.


eg file - with attributes -pkID

source type has pkID and attributes,

I want attributes for those pkID in lookup file.

What would be the query ?

index= sourcetype = attr1 attr2 |lookup from PkID in lookupfile? ??/ How do I make this query ????

Tags (1)
0 Karma


Try this

index=foo sourcetype=bar [| inputlookup lookupfilename.csv | fields PkID] | rest of your search

This should return only events from your index=foo where PkID is in lookupfilename.csv

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>