Splunk Search

inputlook up query


I have an xls input lookup, I'm trying to find members in inputlook in my source type.


eg file - with attributes -pkID

source type has pkID and attributes,

I want attributes for those pkID in lookup file.

What would be the query ?

index= sourcetype = attr1 attr2 |lookup from PkID in lookupfile? ??/ How do I make this query ????

Tags (1)
0 Karma


Try this

index=foo sourcetype=bar [| inputlookup lookupfilename.csv | fields PkID] | rest of your search

This should return only events from your index=foo where PkID is in lookupfilename.csv

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...