Hi
Is there a way to search across multiple Lookup files to find text within them ? I know that you can use | inputlookup to get the contents of a single lookup csv file but I'm trying to search for any csv files that might have a specific string value.
You can use below sample, it will search for "text_to_search" value in all lookups. It is better to limit lookup files by filtering title.
| rest /servicesNS/-/-/data/lookup-table-files f=title
| fields title
| dedup title
| map maxsearches=1000 search="|inputlookup $title$ | fieldsummary |eval lookup_name=$title$ | fields values field lookup_name "
| spath input=values
| rename {}.* as *| fields lookup_name field value
| search value="text_to_search"
Hi,
Thanks i get this error message and only returns a few records guess i don't have enough permissions
Restricting results of the "rest" operator to the local instance because you do not have the "dispatch_rest_to_indexers" capability
There's no need to grab lookup files from the indexers since the SH should have the same ones. Use the splunk_server=local option to suppress the warning.
| rest splunk_server=local /servicesNS/-/-/data/lookup-table-files f=title
| fields title
| dedup title
| map maxsearches=1000 search="|inputlookup $title$ | fieldsummary |eval lookup_name=$title$ | fields values field lookup_name "
| spath input=values
| rename {}.* as *| fields lookup_name field value
| search value="text_to_search"
Searching multiple lookup files requires using multiple lookup commands, one for each file.