topic Re: Splunk Dynamic search using lookup in Splunk Search

Splunk Dynamic search using lookup

rishiaggarwal — Mon, 08 May 2017 08:33:01 GMT

I wish to populate a list of index names ( > 1) from a lookup table to a search query.

Indexlookup.csv -->

COL1

index1
index2
index5
index9

search -->

query | search index="index1" OR index="index2" OR index="index5" OR index="index1" | .........................

gcusello — Mon, 08 May 2017 09:34:10 GMT

Hi rishiaggarwal,
to do this, you have to put your indexes in a lookup with column name called index and use it in a subsearch

your_search [ | inputlookup your_indexes.csv | fields index ] | ...

I don't like this solution, I prefer to put indexes in an eventtype and use it in my searches.

Bye.
Giuseppe

dineshraj9 — Mon, 08 May 2017 10:04:23 GMT

Try this way -

query | search [ | inputlookup Indexlookup.csv | rename COL1 as index | table index ] | ...

query | search [ | inputlookup Indexlookup.csv | rename COL1 as index | table index | format ] | ...

niketn — Mon, 08 May 2017 10:05:31 GMT

I am not sure what you imply by " index names ( > 1) ", however, instead of using the search you have mentioned you can try the following:

<YourBaseSearch> [|inputlookup Indexlookup.csv | rename COL1 as index| table index]
| <Your Remaining Search>

Eshaac — Tue, 29 Sep 2020 22:36:50 GMT

To do this you should create a csv file which contains the header index
e.g. index
xyz
xyz
xzy

exclude adding "index=" to the index value on the lookup.
once this lookup is created use this search string

this will then amalgamate the different indexes and run it!