topic Re: Filtering search results in Splunk Search

Filtering search results

Poacher — Mon, 08 Feb 2021 17:42:10 GMT

I'm a new user of Splunk 6.5.7. I have a search but only want results for 288 specific customerIDs. This would be a very long list of ORs and i don't think 6.5.7 supports an IN function.

So I want a table output like with two columns from my search - CustomerName, CustomerID

But only where the customerID is in my csv of customerIDs. I feel I should be able to do this using a lookup but just can't get it right. Anyone able to help please?

Re: Filtering search results

scelikok — Mon, 08 Feb 2021 18:14:29 GMT

Hi @Poacher,

Please try below options;

| your_search [|inputlookup customerids.csv | fields customerID]

| your_search | lookup customerids.csv customerID OUTPUT customerID AS valid | where isnotnull(valid) | fields - valid

Re: Filtering search results

Poacher — Fri, 12 Feb 2021 08:54:44 GMT

Thank you