Knowledge Management

inputlookup from CSV inside macro -- why doesn't this work as a base search?

dorrfg
Engager

I have a lookup file called us_customers.csv that contains a single field: customer.
I would like to filter the results of my query to the customers in the lookup CSV file.

This query works for me, I see exactly the hosts that belong to the customers:

[ | inputlookup us_customers.csv ] | stats count by host

So I made a macro:

[us_customers]
definition = search [ | inputlookup us_customers.csv ]

And now querying using it:

`us_customers` | stats count by host

I see only a partial result set.

Can anyone explain why this doesn't work?
Thanks.

1 Solution

woodcock
Esteemed Legend

It will work if you do this:

| `us_customers` | stats count by host

And define it like this:

 definition = inputlookup us_customers.csv

View solution in original post

woodcock
Esteemed Legend

It will work if you do this:

| `us_customers` | stats count by host

And define it like this:

 definition = inputlookup us_customers.csv

dorrfg
Engager

Thanks. I understand why it works using a pipe, but I'm wondering why it's no good as a base search.

0 Karma

woodcock
Esteemed Legend

The man who wrote macros is @sideview and he recently commented in slack more fully than he did in this answer:
https://answers.splunk.com/answers/75612/inputlookup-in-a-macro.html

Perhaps he will share some of that additional commentary here now.

DalJeanis
SplunkTrust
SplunkTrust

The word "search" is not needed / not valid in a base search. Try index=* where you have search.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...