Splunk Search

inputlookup csv

Engager

I setup testing.csv lookup as following
host,location
123,HK
234,US
345,UK

I would like to basic search if host matched in the log, stats count by location
index=log sourcetype=csv |search [|inputlookup testing | return $host]
| stats .... by location

But seems return nothings

Labels (2)
Tags (1)
0 Karma
1 Solution

Legend

Hi @keyu921,
the command to use is lookup, try something like this:

index=log sourcetype=csv 
| lookup testing.csv host OUTPUT location
| stats count by location

Remember to define Lookup definitions.

Ciao.
Giuseppe

View solution in original post

0 Karma

Engager

index=* sourcetype=csv |search [|inputlookup testing| return 1000 $host]
| stats last(Size) last(Used) last(Use) by host

0 Karma

Legend

Hi @keyu921,
the command to use is lookup, try something like this:

index=log sourcetype=csv 
| lookup testing.csv host OUTPUT location
| stats count by location

Remember to define Lookup definitions.

Ciao.
Giuseppe

View solution in original post

0 Karma

Engager

thanks seems i mix up inputlookup and lookup

0 Karma