Splunk Search

lookup matching only first record

p_basanth
New Member

i have a lookup file as per below:

fail_reasons

"reason 1"

"reason 2"

"reason 3"

"reason 4"

The lookup is named as errorcode

[|inputlookup errorcode | return $fail_reasons]

the above search matches only those events with reason 1 and not others !!!!

Alternatively (("reason 1") OR ("reason 2") OR ("reason 3") Or ("reason 4")) returns all matching events from the same index and sourcetype.

Any pointer on what mistake i did?

Tags (1)
0 Karma

snoobzilla
Builder

Wondering why you are not using the lookup command instead of inputlookup|return (which seems like it would load entire lookup every time). Granted yours is a small lookup table, but return seems inefficient.

Syntax...

| lookup LOOKUPNAME inputfield1 inputfield2 output outputfield1 outputfield2 outputfield3 ...etc.

As far as I know, the above can be used inline without invoking a subsearch. You could also set up an autolookup for this if the example is as simple as you indicated in you question.

0 Karma

snoobzilla
Builder

Thanks. You are correct. Will edit response.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Per documentation:
Outputlookup

Writes search results to the specified static lookup table.

Inputlookup is the command to get values FROM lookup table.

0 Karma

Ayn
Legend

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Return

 Arguments

<count>
    Syntax: <int> 
    Description: Specify the number of rows. Defaults to 1, which is the first row of results passed into the command. 

Ayn
Legend

Not sure that's related to the subsearch.

0 Karma

p_basanth
New Member

tried rename fail_reasons as query | fields query

and i get the below error

Reached end-of-stream while waiting for more data from peer . Search results might be incomplete !

0 Karma

Ayn
Legend

Oh sorry. It should be "rename fail_reasons as query" not "errorcode". I mixed the lookup name and the field name.

0 Karma

p_basanth
New Member

No Luck !!

0 matching events

The specified search will not match any events

0 Karma

Ayn
Legend

Instead of the return command which requires you to specify a specific number of results to return, a better option would perhaps be to do without return:

[|inputlookup errorcode | rename errorcode as query | fields query]
0 Karma

p_basanth
New Member

Thanks Ayn.
Partially worked. When i use [|inputlookup errorcode | return 10 $fail_reasons], i get the below error
Reached end-of-stream while waiting for more data from peer . Search results might be incomplete !

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...