- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- lookup matching only first record
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
lookup matching only first record
i have a lookup file as per below:
fail_reasons
"reason 1"
"reason 2"
"reason 3"
"reason 4"
The lookup is named as errorcode
[|inputlookup errorcode | return $fail_reasons]
the above search matches only those events with reason 1 and not others !!!!
Alternatively (("reason 1") OR ("reason 2") OR ("reason 3") Or ("reason 4")) returns all matching events from the same index and sourcetype.
Any pointer on what mistake i did?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Wondering why you are not using the lookup command instead of inputlookup|return (which seems like it would load entire lookup every time). Granted yours is a small lookup table, but return seems inefficient.
Syntax...
| lookup LOOKUPNAME inputfield1 inputfield2 output outputfield1 outputfield2 outputfield3 ...etc.
As far as I know, the above can be used inline without invoking a subsearch. You could also set up an autolookup for this if the example is as simple as you indicated in you question.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks. You are correct. Will edit response.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Per documentation:
Outputlookup
Writes search results to the specified static lookup table.
Inputlookup is the command to get values FROM lookup table.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Return
Arguments
<count>
Syntax: <int>
Description: Specify the number of rows. Defaults to 1, which is the first row of results passed into the command.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Not sure that's related to the subsearch.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
tried rename fail_reasons as query | fields query
and i get the below error
Reached end-of-stream while waiting for more data from peer
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Oh sorry. It should be "rename fail_reasons as query" not "errorcode". I mixed the lookup name and the field name.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No Luck !!
0 matching events
The specified search will not match any events
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Instead of the return command which requires you to specify a specific number of results to return, a better option would perhaps be to do without return:
[|inputlookup errorcode | rename errorcode as query | fields query]
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks Ayn.
Partially worked. When i use [|inputlookup errorcode | return 10 $fail_reasons], i get the below error
Reached end-of-stream while waiting for more data from peer
Splunk Custom Visualizations App End of Life
Introducing Splunk Enterprise 9.2
Adoption of RUM and APM at Splunk
