Splunk Search

inputlookup with database lookup


Is there a way to use a database lookup in the way you would using inputlookup? If I wanted to just dump the contents to be searched against? I can do it with dbquery but wonder if there is a way to do this with inputlookup or lookup? I believe inputlookup only work with files (possibly an enhancement?).

This works for file based lookup, would like similar mechanism for database lookup(using dbconnect)

| inputlookup LOOKUPDBTABLE | search BAR_CODE="123*"

Below does not work.

| stats count | eval BAR_CODE="123*" | lookup LOOKUPDBTABLE BAR_CODE


Splunk Employee
Splunk Employee
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!