https://community.splunk.com/t5/Getting-Data-In/Using-a-CSV-to-search/m-p/58375#M11483 <P>you actually can do that quite easily (I had the same issue):</P> <PRE><CODE>sourcetype=*yoursourcetype* [ | inputlookup users.csv | fields user] </CODE></PRE> <P>This will expand to something like this:</P> <PRE><CODE>sourcetype=*yoursourcetype* user=user1 sourcetype=*yoursourcetype* user=user2 </CODE></PRE> <P>Hope this helps!</P> Mon, 15 Aug 2011 22:41:41 GMT Brian_Osburn 2011-08-15T22:41:41Z https://community.splunk.com/t5/Getting-Data-In/Using-a-CSV-to-search/m-p/58374#M11482 <P>I am pretty sure this involves lookups but here is what I am attempting.</P> <P>I have a list of users in a CSV (users.csv) but it's about 70 names. I want to search a certain sourcetype for these names without having to finger bang them in one at a time. How do I do this? I feel like this is covered somewhere and I have RTFM already. Any assistance with an answer or at least a nudge in the right direction would be greatly appreciated!</P> Mon, 15 Aug 2011 21:14:23 GMT https://community.splunk.com/t5/Getting-Data-In/Using-a-CSV-to-search/m-p/58374#M11482 ryangibson99 2011-08-15T21:14:23Z https://community.splunk.com/t5/Getting-Data-In/Using-a-CSV-to-search/m-p/58375#M11483 <P>you actually can do that quite easily (I had the same issue):</P> <PRE><CODE>sourcetype=*yoursourcetype* [ | inputlookup users.csv | fields user] </CODE></PRE> <P>This will expand to something like this:</P> <PRE><CODE>sourcetype=*yoursourcetype* user=user1 sourcetype=*yoursourcetype* user=user2 </CODE></PRE> <P>Hope this helps!</P> Mon, 15 Aug 2011 22:41:41 GMT https://community.splunk.com/t5/Getting-Data-In/Using-a-CSV-to-search/m-p/58375#M11483 Brian_Osburn 2011-08-15T22:41:41Z https://community.splunk.com/t5/Getting-Data-In/Using-a-CSV-to-search/m-p/58376#M11484 <P>AWESOME! Thanks so much!</P> Thu, 18 Aug 2011 17:29:06 GMT https://community.splunk.com/t5/Getting-Data-In/Using-a-CSV-to-search/m-p/58376#M11484 ryangibson99 2011-08-18T17:29:06Z