Need help. How to I obtain the following output? I tried the following SPL but doesn't work.
index=car_record | search [inputlookup sale.csv | table car_brand]
index=car_record [| inputlookup sale.csv | rename car_brand as car_type | table car_type ] | table car_type price quantity date
@linwqg, please try the following and confirm:
index=car_record [| inputlookup sale.csv | rename car_brand as car_type | table car_type]
| <yourRemainingSearch>
Oh, the technique works again.
But then, what if I want to search through all field instead of just car_type field?
You would need to use the format command from Splunk. Try running the following search and you will see what search filter will be applied
| inputlookup sale.csv
| table *
| format
I tried to read up on format cmd.
| inputlookup sale.csv
| table car_brand
| format
The above will create a search from car_brand field. And using the search, i can append to the orig search based on index=car_record?
@linwqg, I think I misunderstood your question. I thought you have multiple fields in your lookup file and you wanted to search those field values in your index.
I think your question is to search for the value from lookup across your index, not just limited to field car_type. If that is so all you need to do is | rename car_brands as search
in your inputlookup command and then do a | table search
. Please try the following and confirm:
index=car_record [| inputlookup sale.csv | rename car_brand as search | table search]
| <yourRemainingSearch>