Splunk Search

inputlookup and append search problem. Expect output all rows but only rows with result shows

netinstall
Engager

Please help, want to do a search based on a table of sever-list and find last update time from a server log. I try to create a table first with 4 server listed, I had one server 2.2.2.2. had result in server log. so I expect the result is 4 rows with 2.2.2.2 had totalcount and date and other is empty/null but showing 4 rows. But the result is the inputlookup and append/appendcols will show 1 row only.

Any method to show 4 rows instead. Can any one had experience on it. Thanks

Using this Searchstring sample

| inputlookup append=true hosts_1.csv  | table yumclientip,team,is_expected,totalcount,yumdate | join yumclientip append [ search xxx yyy zzzz | setfields count="0" yumdate="NA" | stats count as totalcount by yumclientip, yumdate  | fillnull value="(empty)" "totalcount" "yumdate"  | dedup yumclientip sortby +_time ]

csv file hosts)1.csv

##################
yumclientip,team,is_expected
1.1.1.1,teamA,true
2.2.2.2,teamB,true
3.3.3.3,teamC,true
4.4.4.4,teamD,true

Result get (only 2.2.2.2 had data)

########################
yumclientip,team,is_expected,totalcount,yumdate
2.2.2.2,teamA,true,18,2017-07-23

But expect result want 4 rows and not 1 rows only

####################
yumclientip,team,is_expected,totalcount,yumdate
1.1.1.1,teamA,true,empty,empty
2.2.2.2,teamB,true,18,2017-07-23
3.3.3.3,teamC,true,empty,empty
4.4.4.4.teamD,true,empty,empty
0 Karma

DalJeanis
Legend

append is not a valid keyword for join. What this line

| join yumclientip append     [ search ...]

...will do is take the results from the first part of the search, and then try to join that set of records to the set of records returned by the second search, joining them based on the values in the fields named yumclientip and append on each side of the search.

Since the only fields on the right side of the search are totalcount, yumclientip and yumdate, there will never be a match found.

Delete the word "append" from the join clause and see what happens.

I'm still not sure that you have the correct code for what you want, but at least you will get some results.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...