topic Run Splunk query through excel in Splunk Search

Run Splunk query through excel

splunk_learner_ — Fri, 13 Mar 2020 12:45:37 GMT

I am new to Splunk and still learning..

I have more than 100 queries to run when asked during a daily activity and its a pain to copy and do a paste each and every time asked to run by the team for some kind of validation..

Is there any way I can simply run them through excel like a click on query [ by making it as link ] and it simply deploy splunk in browser and run the query? Or any other option to serve the purpose ?

any help would be appreciated..

Thanks...

Re: Run Splunk query through excel

skoelpin — Fri, 13 Mar 2020 14:00:55 GMT

Sounds like a dashboard with multiple panels would be a better option. Also consider scheduled searches which can email results or trigger another action.

Re: Run Splunk query through excel

jpalacian — Fri, 13 Mar 2020 15:00:59 GMT

I'd answer the same like skoelpin, maybe I can add that you can save your queries as reports and your users can access them whenever they need.

Re: Run Splunk query through excel

markthomsen — Sat, 14 Mar 2020 23:00:36 GMT

Maybe this can be done using lookups and the API. You'd load your spreadsheet as a lookup, then use API calls to read that lookup and execute each record (SPL Query) in your spreadsheet. Now that I think about it, you'd have to create a bash or python script to do this, I think.