Hi Folks..
I have a similar requirement wherein I want the name of the lookup file to be print against the data from each of them in the following way. For some reason, the eval function is not giving the desired output. Can anyone help ?
| rest /servicesNS/-/search/data/lookup-table-files splunk_server="local"
| search title="geo_attr*.csv"
| map search="eval lkpnm=$title$ |inputlookup $title$ | stats dc(title) as Count | table lkpnm, Count"
This is giving me the correct count, but not the lookupname!
... View more