https://community.splunk.com/t5/Splunk-Search/Using-value-in-lookup-as-source-in-search/m-p/483930#M135474 <P>Hello,</P> <P>I am new to Splunk so apologies if this question seems overly simple.</P> <P>Currently I have a search where in the query I list off the different sources, e.g.</P> <PRE><CODE> index=my_index host=my_host (source=".../component_1.log" OR source=".../component_2.log" OR ... etc) "keyword" </CODE></PRE> <P>However, requirements have changed and I now need to store that list of sources in a lookup file, which looks like this</P> <PRE><CODE>source, ".../component_1.log" ".../component_2.log" ... ".../component_n.log" </CODE></PRE> <P>Can I take the values stored in the lookup file and use them as a the source value in a subsequent search? It seems like something very easy but I just can't seem to get it right.</P> <P>I have added the lookup correctly to my splunk environment and can see its contents okay.</P> <PRE><CODE>|inputlookup my_lookup.csv </CODE></PRE> <P>I just can't seem to combine the two elements, am I missing something basic?</P> <PRE><CODE>|inputlookup my_lookup.csv | rename source as lookup_source | fields lookup_source | search index=my_index host=my_host source=lookup_source "keyword" </CODE></PRE> <P>Thanks.</P> Fri, 28 Feb 2020 11:45:37 GMT eoghanmcd 2020-02-28T11:45:37Z https://community.splunk.com/t5/Splunk-Search/Using-value-in-lookup-as-source-in-search/m-p/483930#M135474 <P>Hello,</P> <P>I am new to Splunk so apologies if this question seems overly simple.</P> <P>Currently I have a search where in the query I list off the different sources, e.g.</P> <PRE><CODE> index=my_index host=my_host (source=".../component_1.log" OR source=".../component_2.log" OR ... etc) "keyword" </CODE></PRE> <P>However, requirements have changed and I now need to store that list of sources in a lookup file, which looks like this</P> <PRE><CODE>source, ".../component_1.log" ".../component_2.log" ... ".../component_n.log" </CODE></PRE> <P>Can I take the values stored in the lookup file and use them as a the source value in a subsequent search? It seems like something very easy but I just can't seem to get it right.</P> <P>I have added the lookup correctly to my splunk environment and can see its contents okay.</P> <PRE><CODE>|inputlookup my_lookup.csv </CODE></PRE> <P>I just can't seem to combine the two elements, am I missing something basic?</P> <PRE><CODE>|inputlookup my_lookup.csv | rename source as lookup_source | fields lookup_source | search index=my_index host=my_host source=lookup_source "keyword" </CODE></PRE> <P>Thanks.</P> Fri, 28 Feb 2020 11:45:37 GMT https://community.splunk.com/t5/Splunk-Search/Using-value-in-lookup-as-source-in-search/m-p/483930#M135474 eoghanmcd 2020-02-28T11:45:37Z https://community.splunk.com/t5/Splunk-Search/Using-value-in-lookup-as-source-in-search/m-p/483931#M135475 <PRE><CODE>index=my_index host=my_host "keyword" [|inputlookup my_lookup.csv ] </CODE></PRE> Fri, 28 Feb 2020 20:24:41 GMT https://community.splunk.com/t5/Splunk-Search/Using-value-in-lookup-as-source-in-search/m-p/483931#M135475 to4kawa 2020-02-28T20:24:41Z