inputlookup question

[asarolkar]

I cant seem to get my inputlookup setup correctly when I try to do a join on a field called module from syslog and a field called serialno from a correctly configured lookup called syslookup

sourcetype="syslog" module=* | eval serialno=module | lookup syslookup serialno | search serialno=* | table module

There are 20 serial nos
There are 10000 modules

Right now the search above is giving me 10000 modules (instead of 20).

Any idea what I could be wrong here.

[lguinn2]

Let's break it down

sourcetype="syslog" module=* means "find all syslog events that have any value in the module field"

| eval serialno=module means "in each event, assign the value of module to the serialno field". This will overwrite any existing value of serial no. I am not sure why you are doing this. My guess is that this is part of the problem.

| lookup syslookup serialno means "use the serialno field (which now contains the value of module) and match it to the serialno field in the lookup, returning the fields from the lookup table" I can't determine what fields are returned from the lookup.

| search serialno=* means "only keep events that have some value in the serialno field." Since all events at this point will have a serialno field, this can and should be eliminated.

| table module means "only display the module field."

The following search is probably wrong, but closer to what you want:

sourcetype="syslog" module=* | lookup syslookup module OUTPUT serialno | table module serialno

This assumes that your syslookuptable provides a mapping of modules to serial numbers.

Finally, in your question you mention inputlookup, but that is not the command that you are using. What data do you have, and what is the problem that you are trying to solve?

[alacercogitatus · Accepted solution]

You need to "limit" the results from the lookup. Try this:

sourcetype="syslog" module=* |eval serialno=module|join serialno [|inputlookup syslookup|table serialno]|table module