In this example, the states in the United States. On the Visualizations tab, zoom in to see the geometric features.For example, to verify that the geometric features in built-in geo_us_states lookup appear correctly on the choropleth map, run the following search:.You can use the inputlookup command to verify that the geometric features on the map are correct. It restricts inputlookup to a smaller number of lookup table rows, which can improve search efficiency when you are working with significantly large lookup tables. The WHERE clause allows you to narrow the scope of the query that inputlookup makes against the lookup table. When append=false the main search results are replaced with the results from the lookup search. When using the inputlookup command in a subsearch, if append=true, data from the lookup file or KV store collection is appended to the search results from the main search. csv.gz, or a lookup table definition in Settings > Lookups > Lookup definitions. The lookup can be a file name that ends with. The inputlookup command can be first command in a search or in a subsearch. Generating commands use a leading pipe character and should be the first command in a search. The inputlookup command is an event-generating command. Any combination of these operators is permitted. Supports a limited set of search query operators: =, !=,, =, AND, OR, NOT. WHERE clause Syntax: WHERE Description: Use this clause to improve search performance by prefiltering data returned from the lookup table. If start=4, it begins with the fifth event. If start=0, it begins with the first event. start Syntax: start= Description: Specify the 0-based offset of the first event to read.

Default: false max Syntax max= Description: Specify the maximum number of events to be read from the file. Certain error conditions cause the search to fail even when strict=false.

When set to false, many inputlookup error conditions return warning messages but do not otherwise cause the search to fail. This happens even when the errors apply to a subsearch.

strict Syntax: strict= Description: When set to true this argument forces the search to fail completely if inputlookup raises an error. Optional arguments append Syntax: append= Description: If set to true, the data returned from the lookup file is appended to the current set of results rather than replacing it. The lookup table can be configured for any lookup type (CSV, external, or KV store). Syntax: Description: The name of the lookup table as specified by a stanza name in the nf file. If the lookup does not exist, a warning message is displayed (but no syntax error is generated). Syntax: Description: The name of the lookup file must end with. The lookup table can be a CSV lookup or a KV store lookup. Use the inputlookup command to search the contents of a lookup table.

Splunk input lookup