Splunk Search

How to add inputlookup and outputlookup in same search

yuwtennis
Communicator

Hi!

I would like to know if it is possible to add outputlookup and inputlookup in same search.
My purpose is to create a table dynamically and use it in other sub searches.

I thought this can be possible by using subsearches but bit struggling with it.

index=hoge
[ sub search
outputlookup
return ""
]
[ | inputlookup xxxxx]

but alsways the inputlookup runs before the outputlookup.

Any suggestions ?

Thanks,
Yu

Tags (2)
0 Karma

splunkdevabhi
Explorer

eventtype=snow_cmdb_ci_list | dedup sys_id | fields - _bkt, _cd,_indextime,_kv,_raw,_serial,_si,_sourcetype,_subsecond, punct, index, source, sourcetype | inputlookup append=t cmdb_ci_list_lookup | dedup sys_id | outputlookup cmdb_ci_list_lookup

0 Karma

Ayn
Legend

Subsearches always run before the outer searches, as for the order in which subsearches themselves run I don't think there's a guaranteed order for that.

Please tell us more about exactly what you want to accomplish, with examples.

splunkdevabhi
Explorer

Found one such example from Splunk Add-on for ServiceNow :

eventtype=snow_cmdb_ci_list | dedup sys_id | fields - _bkt, _cd,_indextime,_kv,_raw,_serial,_si,_sourcetype,_subsecond, punct, index, source, sourcetype | inputlookup append=t cmdb_ci_list_lookup | dedup sys_id | outputlookup cmdb_ci_list_lookup

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...