Hi Splunkers,
I was wondering if there is a way to output the contents of a Lookup file but also show the Lookup file name as results so for example
| inputlookup append=t <filename1>.csv
| inputlookup append=t <filename2>.csv
| inputlookup append=t <filename3>.csv
Running the above will show the contents but would like to know which file the contents relates to.
Thanks
You can try this ;
| inputlookup append=true test1.csv
| eval order = "test1.csv"
| inputlookup append=true test2.csv
| eval order = if(isnull(order),"test2.csv",order)
| inputlookup append=true test3.csv
| eval order = if(isnull(order),"test3.csv",order)
Thanks. This helps me out
Hi @finchy,
let me understand: you want the list of available lookups, is this correct?
if this is your need, you could use a REST API command:
| rest /services/data/lookup-table-files
filtering results using one or more of the available fields.
Ciao.
Giuseppe