<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Use field values in a query for loop in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/Use-field-values-in-a-query-for-loop/m-p/492777#M194357</link>
    <description>&lt;P&gt;Hi, I want to use field values for a search query and then export the results for each field value to a CSV&lt;BR /&gt;
For example, I have a list of field values&lt;/P&gt;

&lt;P&gt;Then for each of these values, I will use them in a search query&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;list = [1,2,3]

for LIST_VALUE in list:
"index="foo" source="bar"
where name=&amp;lt;LIST_VALUE&amp;gt;

outputcsv &amp;lt;LIST_VALUE&amp;gt;.csv 
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Is this possible? Thanks!&lt;/P&gt;</description>
    <pubDate>Fri, 08 May 2020 22:28:21 GMT</pubDate>
    <dc:creator>nwong1</dc:creator>
    <dc:date>2020-05-08T22:28:21Z</dc:date>
    <item>
      <title>Use field values in a query for loop</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Use-field-values-in-a-query-for-loop/m-p/492777#M194357</link>
      <description>&lt;P&gt;Hi, I want to use field values for a search query and then export the results for each field value to a CSV&lt;BR /&gt;
For example, I have a list of field values&lt;/P&gt;

&lt;P&gt;Then for each of these values, I will use them in a search query&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;list = [1,2,3]

for LIST_VALUE in list:
"index="foo" source="bar"
where name=&amp;lt;LIST_VALUE&amp;gt;

outputcsv &amp;lt;LIST_VALUE&amp;gt;.csv 
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Is this possible? Thanks!&lt;/P&gt;</description>
      <pubDate>Fri, 08 May 2020 22:28:21 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Use-field-values-in-a-query-for-loop/m-p/492777#M194357</guid>
      <dc:creator>nwong1</dc:creator>
      <dc:date>2020-05-08T22:28:21Z</dc:date>
    </item>
    <item>
      <title>Re: Use field values in a query for loop</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Use-field-values-in-a-query-for-loop/m-p/492778#M194358</link>
      <description>&lt;P&gt;use &lt;CODE&gt;map&lt;/CODE&gt; command&lt;/P&gt;</description>
      <pubDate>Sat, 09 May 2020 00:40:31 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Use-field-values-in-a-query-for-loop/m-p/492778#M194358</guid>
      <dc:creator>to4kawa</dc:creator>
      <dc:date>2020-05-09T00:40:31Z</dc:date>
    </item>
  </channel>
</rss>

