Splunk Search

How do I search a csv file created via Outputlookup?

mshapirovp
Explorer

I am creating lookup csv files for my app on a nightly basis via scheduled searches doing search | outputlookup mydata.csv.

I have verified that the mydata.csv exists under my app's lookups directory, and it contains the correct data. However, when running inputlookup mydata.csv no results come back.

What am I doing wrong?

Tags (1)
0 Karma

mshapirovp
Explorer

It appears that you must start the search with a pipe. I was trying:

inputlookup mydata.csv

But got no results. What I should have been searching for was:

| inputlookup mydata.csv

That pipe made it work.

grijhwani
Motivator

That'll do it...

0 Karma

mshapirovp
Explorer

I had actually posted the complete search I was trying in the post itself, but I just across a "ah-ha" moment that showed me what I was doing wrong. I needed to add a pipe before the inputlookup command before I would get results

0 Karma

grijhwani
Motivator

Perhaps a flaw in your inputlookup usage, but if you don't post an example search we cannot see.

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...