Splunk Search

lookup data not population in final part of query

vk1544
Explorer

Hi all

i have the below query where i have a lookup  file with Error messages im trying to match the error messages in the lookup and then matching those in the rawdata and showing in table. However my final result query field is coming as empty rest all are populating. Need help in the query i was trying to add before the table command | lookup ErrorMessage.csv  query OUTPUT query but not working need help 

index=abc host="LINUX123" " source="/new/dir/apps/servers/service*.log"  "Error data*"  [ | inputlookup ErrorMessage.csv | fields + ErrorMessage | rename ErrorMessage as query] | table _time,host,query, _raw

 

lookup file content

ErrorMessage.csv

File Not Found

Error data in client transacton

 

thanks in advance 

 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The query field (like the search field) are special cases in subqueries as they are not passed to the outer search, only their values are. This is why the final query field is empty.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...