Splunk Search

How to dynamically append the content of multiple lookup files?

D2SI
Communicator

Hello there,

I am trying to dynamically append the content of multiple lookup files but I am not sure it is possible.

Here how I do for now:

| inputlookup geo_attr_countries.csv
| inputlookup append=true geo_attr_us_states.csv

It is working fine but I was wondering if I could build that search without having to explicitly list lookup files.

I can build a search to retrieve the lookups:

| rest /servicesNS/-/search/data/lookup-table-files splunk_server="local"
| search title="geo_attr*.csv"
| fields title

geo_attr_countries.csv
geo_attr_us_states.csv

But I do not see how I can use this to build the search.

I was thinking of something like:

| rest /servicesNS/-/search/data/lookup-table-files splunk_server="local"
| search title="geo_attr*.csv"
| fields title
| foreach title [| inputlookup append=true <<FIELD>>]

But I would get this error:

Error in 'foreach' command: Search pipeline may not contain non-streaming commands.

So I am stuck, any idea on how to achieve this?

Thanks in advance

0 Karma
1 Solution

HiroshiSatoh
Champion

You can do this using the map function.

| rest /servicesNS/-/search/data/lookup-table-files splunk_server="local"
| search title="geo_attr*.csv"
| map search="|inputlookup $title$"

View solution in original post

HiroshiSatoh
Champion

You can do this using the map function.

| rest /servicesNS/-/search/data/lookup-table-files splunk_server="local"
| search title="geo_attr*.csv"
| map search="|inputlookup $title$"

D2SI
Communicator

Damn, I did not know about this command, does it perfectly well!

Thanks a lot!

0 Karma

swetvenk
New Member

Hi Folks..

I have a similar requirement wherein I want the name of the lookup file to be print against the data from each of them in the following way. For some reason, the eval function is not giving the desired output. Can anyone help ?

| rest /servicesNS/-/search/data/lookup-table-files splunk_server="local"
| search title="geo_attr*.csv"
| map search="eval lkpnm=$title$ |inputlookup $title$ | stats dc(title) as Count | table lkpnm, Count"

This is giving me the correct count, but not the lookupname!

0 Karma

D2SI
Communicator

Hi @swetvenk, I would do something like this :

| rest /servicesNS/-/search/data/lookup-table-files splunk_server="local" 
| search title="geo_attr*.csv" 
| map search="| makeresults | eval lkpnm=$title$ | append [| inputlookup $title$]| eventstats last(lkpnm) as lkpnm | search NOT _time="*""
| stats count by lkpnm
0 Karma

MikeElliott
Communicator

Have you tried the same with | outputlookup append=true <> ?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...