https://community.splunk.com/t5/Splunk-Search/To-include-80-applications-in-SPL/m-p/459211#M129664 <P>Hello Everyone,</P> <P>I have got the list of 80+ applications this I want to include in my SPL. Is there a way I can use CSV lookup to do that? The applications list look like:-</P> <PRE><CODE>APP-ID,DESCRIPTION A1*,test app 1 B2*,test app 2 C3*,test app 3 D4*,test app 4 ... </CODE></PRE> <P>Sample SPL I would like to create to include these applications:-</P> <PRE><CODE>index=app-data APP-ID=A1* OR APP-ID=B2* OR APP-ID=C3* OR APP-ID=D4*.... | </CODE></PRE> <P>I am not using the DESCRIPTION as mentioned in the sample CSV above at this stage. I am just trying to figure out if there is a way to look up these applications from a CSV file rather then having to type these in the SPL or if there is any other alternative please suggest. </P> <P>Thank you,<BR /> Rajat</P> Thu, 22 Aug 2019 13:30:01 GMT rajatsinghbagga 2019-08-22T13:30:01Z https://community.splunk.com/t5/Splunk-Search/To-include-80-applications-in-SPL/m-p/459211#M129664 <P>Hello Everyone,</P> <P>I have got the list of 80+ applications this I want to include in my SPL. Is there a way I can use CSV lookup to do that? The applications list look like:-</P> <PRE><CODE>APP-ID,DESCRIPTION A1*,test app 1 B2*,test app 2 C3*,test app 3 D4*,test app 4 ... </CODE></PRE> <P>Sample SPL I would like to create to include these applications:-</P> <PRE><CODE>index=app-data APP-ID=A1* OR APP-ID=B2* OR APP-ID=C3* OR APP-ID=D4*.... | </CODE></PRE> <P>I am not using the DESCRIPTION as mentioned in the sample CSV above at this stage. I am just trying to figure out if there is a way to look up these applications from a CSV file rather then having to type these in the SPL or if there is any other alternative please suggest. </P> <P>Thank you,<BR /> Rajat</P> Thu, 22 Aug 2019 13:30:01 GMT https://community.splunk.com/t5/Splunk-Search/To-include-80-applications-in-SPL/m-p/459211#M129664 rajatsinghbagga 2019-08-22T13:30:01Z https://community.splunk.com/t5/Splunk-Search/To-include-80-applications-in-SPL/m-p/459212#M129665 <P>Hello,</P> <P>If you already have the csv as a lookup, it's perfect.<BR /> You can do something like that in your SPL :</P> <PRE><CODE>index=app-data [|inputlookup yourLookup | fields APP-ID] </CODE></PRE> <P>It should work for you.</P> <P>Kail</P> Thu, 22 Aug 2019 14:01:50 GMT https://community.splunk.com/t5/Splunk-Search/To-include-80-applications-in-SPL/m-p/459212#M129665 KailA 2019-08-22T14:01:50Z