Hi all, have been using the splunklib package in Python to connect to the Splunk API for some time now, and it works fine. As sample search I use is provided below: searchquery = """search index=wineventlog EventCode=4688 earliest=-4h | fields user, ETC, ETC, ETC | table user, ETC, ETC, ETC""" resolveQuery = SplunkQuery(host, port, username, password) df = resolveQuery.splunk_fetch(searchquery) The search return a pandas dataframe (in Python) containing the required information. When I try to retrieve an inputlookup however, the search doesn't return any information, only an empty dataframe.  Below is an example of a searchquery I use to try and retrieve an inputlookup: searchquery = """search | inputlookup infomation.csv""" Any help would be highly appreciated: how can I retrieve inputlookups using the Splunklib package in Python? ... View more

I have a query which runs once a day and which produces a list of all countries a user has visited over the last 30 days.  Below is an example of this list which I call 'Country_hist': I have another query which runs far more often, and which generates a list of all countries a user has visited over the past 24 hours. I want to compare the list of countries from this query with the countries on the  'Country_hist'-list. I added a screenshot below to show you what I mean. On the left side is a column with the countries a user visited over the past 24 hours, on the right side we have to history columns: I then do a check if items in the left column are also in the right column: has the user visited a country in the last 24 hours which he has not visited before over the past 30 days. My problem is that both lists are not the same. In the screenshot above please look at the location of the cursor: in the left hand column Japan and South Korea are not on the same row (separated by what seems to be an enter), while they are on the same row in the right hand column. So the left column contains: Japan South Korea   And the right column contains: Japan South Korea     Currently I use this function to compare the two columns: | eval check=if(isnull(Country_hist), 0, if(like(Country_hist, "%"+$Country_lst1$+"%"), 0, 1)) This returns a 1 in the example above, but I would want it to return a 0 (since the visited countries are the same). How can I fix this, so Splunk understands that values are the same even if they are on different rows? Thanks! ... View more