Splunk Search

How to make inputlookup return function check all records (rows) in a CSV?

orion44
Communicator

Currently the inputlookup return function requires you to input a hardcoded total of records to check when used in a subsearch. Why is this required and how do you make it return all records?

Example usage:

index=logs [| inputlookup data.csv | return 1000 name=$hostname]

I have to hard code the "1000" to tell Splunk to check 100 records in the lookup. This requirement is illogical as I always want it to check (lookup) ALL records. As a workaround, I just pick a high number that exceeds the total rows in the CSV.

0 Karma
1 Solution

niketn
Legend

@orion44 try the following

Using the table command in the sub-search:

index=logs 
    [| inputlookup data.csv 
    | fields hostname 
    | rename hostname as name 
    | table name ]

Or using the format command

index=logs 
    [| inputlookup data.csv 
   | fields hostname
   | rename hostname as name
   | format]
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@orion44 try the following

Using the table command in the sub-search:

index=logs 
    [| inputlookup data.csv 
    | fields hostname 
    | rename hostname as name 
    | table name ]

Or using the format command

index=logs 
    [| inputlookup data.csv 
   | fields hostname
   | rename hostname as name
   | format]
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

orion44
Communicator

Works perfectly, thanks!

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...