9/15/2023 0 Comments Splunk base subsearch input![]() ![]() csv.gz, or a lookup table definition in Settings > Lookups > Lookup definitions. The lookup can be a file name that ends with. The inputlookup command can be first command in a search or in a subsearch. Generating commands use a leading pipe character and should be the first command in a search. The inputlookup command is an event-generating command. ![]() Any combination of these operators is permitted. Supports a limited set of search query operators: =, !=,, =, AND, OR, NOT. WHERE clause Syntax: WHERE Description: Use this clause to improve search performance by prefiltering data returned from the lookup table. If start=4, it begins with the fifth event. If start=0, it begins with the first event. start Syntax: start= Description: Specify the 0-based offset of the first event to read. Default: false max Syntax max= Description: Specify the maximum number of events to be read from the file. Certain error conditions cause the search to fail even when strict=false. When set to false, many inputlookup error conditions return warning messages but do not otherwise cause the search to fail. This happens even when the errors apply to a subsearch. strict Syntax: strict= Description: When set to true this argument forces the search to fail completely if inputlookup raises an error. Optional arguments append Syntax: append= Description: If set to true, the data returned from the lookup file is appended to the current set of results rather than replacing it. ![]() The lookup table can be configured for any lookup type (CSV, external, or KV store). Syntax: Description: The name of the lookup table as specified by a stanza name in the nf file. If the lookup does not exist, a warning message is displayed (but no syntax error is generated). Syntax: Description: The name of the lookup file must end with. The lookup table can be a CSV lookup or a KV store lookup. Use the inputlookup command to search the contents of a lookup table. ![]()
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |