Is there a way to use a database lookup in the way you would using inputlookup? If I wanted to just dump the contents to be searched against? I can do it with dbquery but wonder if there is a way to do this with inputlookup or lookup? I believe inputlookup only work with files (possibly an enhancement?).
This works for file based lookup, would like similar mechanism for database lookup(using dbconnect)
| inputlookup LOOKUPDBTABLE | search BAR_CODE="123*"
Below does not work.
| stats count | eval BAR_CODE="123*" | lookup LOOKUPDBTABLE BAR_CODE
Thanks,
Bob
Hi, does this work for you? http://docs.splunk.com/Documentation/DBX/1.0.11/DeployDBX/Setupadatabaselookuptable