Using a .csv as part of a search

cpressl — Sat, 04 Mar 2017 23:22:46 GMT

New splunk user, trying to get my feet under me. here's the situation;

We have a rather large splunk deployment, and my group often does searches using phone number (TN). Some of our searches involve a lot of numbers, so the search is basically "WTN=0000000000 OR WTN=1111111111 OR..." repeated about a thousand times (not exaggerating, BTW). I've been told that it's easier and faster to use a lookup table instead, but all the reading on lookup tables I've found seem to indicate that adding the .csv makes it more or less a permanent addition to the splunk data, not to mention that the whole process seems kinda convoluted for a simple (and often one-time) search.

Basically, what I'd like to do is be able to say "search index x for the TNs in this .csv, and return these fields" more or less on the fly, without adding a lot of data to splunk that will most likely never be used again. Is there an easy way to do this? Thanks!

Re: Using a .csv as part of a search

woodcock — Sun, 05 Mar 2017 09:15:51 GMT

Let's assume that you have a lookup file called WTN.csv which has a header line that says only WTN. You can skip all WTNs in the file like this:

Your Search Here NOT [|inputscsv WTN.csv]

topic Using a .csv as part of a search in Getting Data In

Using a .csv as part of a search

Re: Using a .csv as part of a search