Splunk Search Command Series: inputlookup and outputlookup

 

Think back to our article on the Splunk search command, lookup… we talked about lookups and how they can be used to enrich the data currently in Splunk. Let’s revisit some new ways we can use lookups in our Splunk environment.

Using Inputlookup

Where the lookup search command allows you to inject fields from lookup to the data in an index, inputlookup will allow you to just view the lookup. This can be used at the beginning of a search, halfway through (using append or join), or where you see fit to bring in a lookup.

Let’s take a look at the syntax:

Syntax: |inputlookup <lookup_name>

Easy, peasy.

 

Figure 1 - Using inputlookup in Splunk

Figure 1 – Using inputlookup in Splunk

Interestingly enough, the lookup captured in the screenshot was built with the second command in this article: outputlookup

Lookups in Splunk are not just tables that get ingested… they can also be created from data we already have.

Using Outputlookup

Whenever you find yourself with a results table that you’d like to hold onto, use outputlookup. When you throw outputlookup at the end of the search, and it will turn the results into a lookup that you can use indepentently.

Let’s take a look at the syntax:

|outputlookup <lookup_name>

 

Figure 2 - Using outputlookup in Splunk

Figure 2 – Using outputlookup in Splunk

There are a few extra lines that can be added if need be. Lines like append=true and overwrite=true will change based on how the lookup is created.

Outputlookup really shines when it comes to building out a list of suspicious values in Splunk (such as a watchlist, blacklist, or whitelist).  All it takes is to build out a results table in Splunk that contains the information you need.

Ask the Experts

Our Splunk Search Command Series is created by our Expertise on Demand (EOD) experts. Every day, our team of Splunk certified professionals works with customers through Splunk troubleshooting support, including Splunk search command best practice. If you’re interested in learning more about our EOD service or chat with our team of experts, fill out the form below!

Author

Start typing and press Enter to search