One source of truth

drezanka — Fri, 26 Feb 2021 18:04:08 GMT

I have an app with dozens of searches that refer to "groupings" of indexes based on several types of criteria. I would like to have one "source of truth" for each grouping so when a index is retired and new ones are added I can just edit one thing instead of dozens of searches. I have tried using a csv lookup but am having problems getting the search to work. Here is a simplified example of the csv file:

type,index_list
rabbits,index="bunny_index" OR index="jackrabbit_index"
stones,index="turquoise" OR index="slate"
dogs,index="spaniels" OR index="hounds"
all,index="bunny_index" OR index="jackrabbit_index" OR index="turquoise" OR index="slate" OR index="spaniels" OR index="hounds"
mammals="bunny_index" OR index="jackrabbit_index" OR "spaniels" OR index="hounds"

I have tried running:

| inputlookup mycsvfile where type=rabbits | search index_list

but I get "No results found." (If I run index="bunny_index" OR index="jackrabbit_index" I do get results).

Grabbing that list of indexes to search from a centralized location would be a huge improvement over our current setup so any input would be very much appreciated.

Re: One source of truth

richgalloway — Fri, 26 Feb 2021 18:54:55 GMT

The problem with the existing query is the search command is looking in the default indexes for the literal string "index=bunny_index OR index=jackrabbit_index", which seems unlikely to be found. Try using the return command to extract the value of the index_list field.

sourcetype=* [| inputlookup mycsvfile where type=rabbits | return $index_list] | ...

Re: One source of truth

drezanka — Fri, 26 Feb 2021 19:44:05 GMT

That works! Thank you.

topic Re: One source of truth in Splunk Search

One source of truth

Re: One source of truth

Re: One source of truth