I tried to use regex on inputlookup csv file, but seems that although Splunk regex works fine on search but
it doesnt work on inputlookup tables.
Is there anyway to add a python script that takes the input csv file and then gives me the parsed value from the regex to be piped for next processing ?
i.e.
| inputlookup data.csv python_regex_script.py | table regex_field
Also as a general question, is it possible to add python script in a splunk search query ?
Thanks! I am going through the examples right now.
Will get back if I run into any issues.
One cannot use a regex with inputlookup directly. However, there are other options.
If you're running 6.3.3, you may be able to use inputlookup's where argument to filter the lookup data
Pipe the lookup to regex
as in |inputlookup data.csv foo | regex "some regex string" | ...
Create a custom command that reads and processes your CSV file. See the script
command at http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Script and "About writing custom search commands" at http://docs.splunk.com/Documentation/Splunk/6.3.3/Search/Aboutcustomsearchcommands.
Not sure what you intended to do, but if you had this lookup file:
customer host service
Customer1 ABC123431 Service1
Customer2 ABC123300 Service2
Customer3 ABC123321 Service3
And you are interested in what comes after the ABC in the host field, you can simply do this:
| inputlookup file.csv | rex field=host "ABC(?<host_id>\d+)" | table customer host host_id service
The rex command will extract any regular expression from any field you tell it to, no matter the source.