Splunk Search

inputlookup - Is it possible to pass lookup table size to return command?

rolaso
Explorer

Hi everyone,

I am trying to find a way count the lines inside a lookup table and pass it to the return command.

For example:

I am currently using:
index=index_foo [|inputlookup lookup_table_name | return 479 $field1 ]

This works fine, but its a maintenance nightmare as the table changes size often. I wrote the following to try to have the subsearch count the rows and return them all:

index=index_foo [|inputlookup lookup_table_name | stats count | return count $field1 ]

unfortunately, that returns count="479"

Is there a way to accomplish what I am trying to do?

Thanks!

1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You can avoid return and hence the need to specify a number entirely by using the magic field name query like this:

index=foo [inputlookup lookup_table_name | rename field1 as query | fields query]

That subsearch will evaluate to ( (v1) OR (v2) OR ... (vn) ) rather than ( (key=v1) OR (key=v2) OR ... (key=vn) )

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You can avoid return and hence the need to specify a number entirely by using the magic field name query like this:

index=foo [inputlookup lookup_table_name | rename field1 as query | fields query]

That subsearch will evaluate to ( (v1) OR (v2) OR ... (vn) ) rather than ( (key=v1) OR (key=v2) OR ... (key=vn) )

rolaso
Explorer

This solution worked perfectly. Many thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...