i have a lookup file as per below:
fail_reasons
"reason 1"
"reason 2"
"reason 3"
"reason 4"
The lookup is named as errorcode
[|inputlookup errorcode | return $fail_reasons]
the above search matches only those events with reason 1 and not others !!!!
Alternatively (("reason 1") OR ("reason 2") OR ("reason 3") Or ("reason 4")) returns all matching events from the same index and sourcetype.
Any pointer on what mistake i did?
Wondering why you are not using the lookup command instead of inputlookup|return (which seems like it would load entire lookup every time). Granted yours is a small lookup table, but return seems inefficient.
Syntax...
| lookup LOOKUPNAME inputfield1 inputfield2 output outputfield1 outputfield2 outputfield3 ...etc.
As far as I know, the above can be used inline without invoking a subsearch. You could also set up an autolookup for this if the example is as simple as you indicated in you question.
Thanks. You are correct. Will edit response.
Per documentation:
Outputlookup
Writes search results to the specified static lookup table.
Inputlookup is the command to get values FROM lookup table.
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Return
Arguments
<count>
Syntax: <int>
Description: Specify the number of rows. Defaults to 1, which is the first row of results passed into the command.
Not sure that's related to the subsearch.
tried rename fail_reasons as query | fields query
and i get the below error
Reached end-of-stream while waiting for more data from peer
Oh sorry. It should be "rename fail_reasons as query" not "errorcode". I mixed the lookup name and the field name.
No Luck !!
0 matching events
The specified search will not match any events
Instead of the return command which requires you to specify a specific number of results to return, a better option would perhaps be to do without return:
[|inputlookup errorcode | rename errorcode as query | fields query]
Thanks Ayn.
Partially worked. When i use [|inputlookup errorcode | return 10 $fail_reasons], i get the below error
Reached end-of-stream while waiting for more data from peer