search against a lookup table

[linwqg]

Need help. How to I obtain the following output? I tried the following SPL but doesn't work.

index=car_record | search [inputlookup sale.csv | table car_brand]

[logloganathan]

index=car_record [| inputlookup sale.csv | rename car_brand as car_type | table car_type ] | table car_type price quantity date

[niketn]

@linwqg, please try the following and confirm:

index=car_record  [| inputlookup sale.csv | rename car_brand as car_type | table car_type]
| <yourRemainingSearch>

[linwqg]

Oh, the technique works again.

But then, what if I want to search through all field instead of just car_type field?

[niketn]

You would need to use the format command from Splunk. Try running the following search and you will see what search filter will be applied

| inputlookup sale.csv
| table *
| format

[linwqg]

I tried to read up on format cmd.

| inputlookup sale.csv
| table car_brand
| format

The above will create a search from car_brand field. And using the search, i can append to the orig search based on index=car_record?

[niketn]

@linwqg, I think I misunderstood your question. I thought you have multiple fields in your lookup file and you wanted to search those field values in your index.

I think your question is to search for the value from lookup across your index, not just limited to field car_type. If that is so all you need to do is | rename car_brands as search in your inputlookup command and then do a | table search. Please try the following and confirm:

 index=car_record  [| inputlookup sale.csv | rename car_brand as search | table search]
 | <yourRemainingSearch>