Knowledge Management

inputlookup from CSV inside macro -- why doesn't this work as a base search?

dorrfg
Engager

I have a lookup file called us_customers.csv that contains a single field: customer.
I would like to filter the results of my query to the customers in the lookup CSV file.

This query works for me, I see exactly the hosts that belong to the customers:

[ | inputlookup us_customers.csv ] | stats count by host

So I made a macro:

[us_customers]
definition = search [ | inputlookup us_customers.csv ]

And now querying using it:

`us_customers` | stats count by host

I see only a partial result set.

Can anyone explain why this doesn't work?
Thanks.

1 Solution

woodcock
Esteemed Legend

It will work if you do this:

| `us_customers` | stats count by host

And define it like this:

 definition = inputlookup us_customers.csv

View solution in original post

woodcock
Esteemed Legend

It will work if you do this:

| `us_customers` | stats count by host

And define it like this:

 definition = inputlookup us_customers.csv

dorrfg
Engager

Thanks. I understand why it works using a pipe, but I'm wondering why it's no good as a base search.

0 Karma

woodcock
Esteemed Legend

The man who wrote macros is @sideview and he recently commented in slack more fully than he did in this answer:
https://answers.splunk.com/answers/75612/inputlookup-in-a-macro.html

Perhaps he will share some of that additional commentary here now.

DalJeanis
SplunkTrust
SplunkTrust

The word "search" is not needed / not valid in a base search. Try index=* where you have search.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...