Splunk Search

inputlookup special fields

acadea
Explorer

Hello,
I have recently found there is a strange difference between lookup and inputlookup commands.

 

|makeresults | eval uid="asdf" | lookup mydata uid 

|makeresults | eval uid="asdf" | join uid [| inputlookup mydata] 

 

The "mydata" lookup is a kvstore collection, with the following columns
uid, name, address, fields
I was expecting these two queries to have the same results, but no.
It seems the column "fields" is an array and it's returning a lot of data when used with the inputlookup command , which is not the case with the first (lookup) query.

The lookup results are like this:
_key | uid  | name | address | fields
...  | asdf | john | yes     | (empty)

The inputlookup results are like this:

_key | uid  | name | address | fields.town | fields.country
...  | asdf | john | yes     | chicago     | usa

I didn't find any documentation about this.
Your input is welcomed.
Thanks

Labels (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes, there is a difference between lookup and inputlookup, but it's not that strange.

The lookup command searches a lookup table for the given field(s) and returns the corresponding fields for the found value.  It's like getting someone's phone number from a telephone directory (remember those?) - find name, return number.

The inputlookup command returns the entire contents of the lookup file (unless the where option is used).  It's the equivalent of saying "read to me the whole phone book".  It has nothing to do with how the columns are named.

I hope this explains why your queries behave the way they do.

---
If this reply helps you, Karma would be appreciated.

acadea
Explorer

that's the definition, it's obvious they are different commands

but the results of those two commands should have been the same.

I'm still digging, it seems the "fields" it's an array

that makes me think lookup cannot deal with displaying  arrays while inputlookup can show them

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I think the difference in output comes from the join command,  By default, it uses an inner join when perhaps you're expecting an outer join.

Try 

|makeresults | eval uid="asdf" | join type=outer uid [| inputlookup mydata]

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

acadea
Explorer

thank you,
I've edited/updated the initial question with an example

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...