topic inputcsv match anywhere in Getting Data In

inputcsv match anywhere

reed_kelly — Mon, 28 Sep 2020 13:51:04 GMT

I have a list of usernames in a CSV file. I want to find any events that contain any of these usernames in _raw. I cannot guarantee that there is a field called user or affected_user for every event, so I want to match anywhere in the string. If I try the following, it only matches for the first user:

.. [ inputcsv userlist.csv |return $user ]

but this only matches on the first user in the list.

Does anyone know how I can match any of the users (words) in a list?

This should be the same whether I am using inputcsv or inputlookup.

Re: inputcsv match anywhere

reed_kelly — Tue, 07 May 2013 15:04:17 GMT

Running 4.3.1 search head...

Re: inputcsv match anywhere

Ayn — Tue, 07 May 2013 15:05:09 GMT

... [inputcsv userlist.csv | rename user as query | fields query]

"query" (or "search" if you prefer, has same effect) is a special field name that makes Splunk omit the 'field=value' formatting when returning from a subsearch.