Splunk® Enterprise

Search Reference

Download manual as PDF

Download topic as PDF



Loads search results from a specified lookup table.


inputlookup [append=<bool>] [start=<int>] [max=<int>] (<filename> | <tablename>)

Required arguments

Syntax: <string>
Description: The name of the lookup file (must end with .csv or .csv.gz). If the lookup does not exist, Splunk displays a warning message, but it does not generate a syntax error).
Syntax: <string>
Description: The name of the lookup table as specified by a stanza name in transforms.conf. The lookup table can be configured for any lookup type (CSV, external, or KV store).

Optional arguments

Syntax: append=<bool>
Syntax max=<int>
Syntax: start=<int>


Lets you search the contents of a lookup table as specified by a file name (must end with .csv or .csv.gz) or a lookup table configuration in transforms.conf. The lookup table can be a CSV lookup or a KV store lookup.

If append is set to true, Splunk Enterprise appends the data from the lookup file or KV store collection to the current set of results. append is set to false by default, which means that it replaces the current result set with the results from the lookup search.

For more information about lookup table configuration, see "Configure CSV and external lookups" and "Configure KV store lookups" in the Knowledge Manager Manual.

For more information about the App Key Value store, see "About KV store" in the Admin Manual.



| inputlookup usertogroup


| inputlookup append=t usertogroup


| inputlookup users.csv

Example 4: Search on the contents of the KV store collection kvstorecoll. It is referenced in a lookup table called kvstorecoll_lookup. Provide a count of the events received from the table.

| inputlookup kvstorecoll_lookup | stats count






| inputlookup customers.csv | outputlookup kvstorecoll_lookup

See also

inputcsv, join, lookup, outputlookup






What does it mean to use |inputlookup with an external lookup? How does an external lookup author recognize her script is being invoked via inputlookup as opposed to traditional field mapping? What output should an external lookup author produce?

October 31, 2014

Was this documentation topic helpful?





0 out of 1000 Characters