Splunk Search

How to access fields within a subsearch / Inputlookup

wrussell12
Explorer

I cannot figure out how to use a variable to relate to a inputlookup csv field.

service_tier.csv

region, plan, price
USA, tier2, 100
CAN, tier1, 25

user_service_plans.csv

user, plan
mike, tier1
james, tier2

regions.csv

type, address, region
home, abc123, usa
work, 123cba, usa
home, xyz123, can
work 321xyz, can

I have a search that returns me a user, and their current region. I want to determine which address they have

|inputlookup service_tier.csv |eval user="mike" | eval TYPE="home"| join plan [|inputlookup user_service_plans.csv | where USER=user] | join type=inner region [|inputlookup regions.csv | where type=TYPE ] | where plan=tier1

the eval user, and eval TYPE are empty in the sub searches. If I hardcode the | where USER="mike" and | where type="HOME" I get the correct results.

How do I make my search visible to the subsearch lookups?

0 Karma

DavidHourani
Super Champion

Hi @wrussell12,

Use this instead to combine your three csv files together at minimum resource cost :

|inputlookup user_service_plans.csv where plan="tier1" AND user="mike" 
| lookup  service_tier.csv  plan
| eval region=lower(region), type="home" 
|lookup regions.csv region, type

Cheers,
David

0 Karma

harshpatel
Contributor

Hi @wrussell12,

You can use command lookup.

For example:

| inputlookup service_tier.csv 
| eval user="mike" 
| eval TYPE="home" 
| lookup your_lookup.csv field1_from_lookup, field2_from_lookup output new_field_from_lookup

But keep in mind: lookup and join differences

If your use case requires you to use join then you can find this helpful - join.

0 Karma

wrussell12
Explorer

Am I doing this wrong? How an search a lookup for specific field(s)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...