topic Re: How do I search multiple source types based on a lookup file? in Getting Data In

How do I search multiple source types based on a lookup file?

tusharsaran1 — Thu, 25 Oct 2018 14:07:55 GMT

Is there a way to search events from multiple source types when the list of source types is available in a lookup file?

Re: How do I search multiple source types based on a lookup file?

osakachan — Thu, 25 Oct 2018 15:23:35 GMT

Hi @tusharsaran1 ,

Try this ...

in the search part of the query add this subsearch

[ |inputlookup lookup
|fields sourcetype
| format]

If the field of the lookup is sourcetype and the values are correctly you will have something like this
( ( sourcetype="a" ) OR ( sourcetype="b" ) OR... etc

Here de docs of format http://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Format

Re: How do I search multiple source types based on a lookup file?

KailA — Thu, 25 Oct 2018 20:25:46 GMT

HI !

To complete a bit @elpred0 answer, if you are not used to play with sub search, this is a more complete example of what your search should look like.

index=yourIndex [|inputlookup sourcetype.csv | fields sourcetype]
| your search

That should return all the events in yourIndex with the specified sourcetype in sourcetype.csv

KailA