topic Re: search a list of servers from a text file in Splunk Search

How to search a list of servers from a text file?

supersnedz — Tue, 10 May 2022 14:15:07 GMT

Hello, I have been given a list of 40 servers in a text file, all servers are separated by commas for example:

server1, server2, server3 etc

I cant upload the text file to splunk and compare the data that way, so is there a way in the search field i can just list all the servers and search my index? I know i can do OR between each one but im sure there is a quicker way?

Thanks,

Allan

Re: search a list of servers from a text file

gcusello — Tue, 10 May 2022 10:55:31 GMT

Hi @supersnedz,

why cannot you upload a file? can you access the Lookup Editor App?

Anyway, even if you cannot upload a file, are you able to create a lookup?

you could manually add your host list to the lookup.

tha choice you could run a search like this:

index=your index NOT host IN (server1, server2, server3)

Ciao.

Giuseppe

Re: search a list of servers from a text file

supersnedz — Tue, 10 May 2022 11:00:52 GMT

Hi Giuseppe,

Thank you for the response. Our splunk is run by a team in another country, and they dont allow local entities to upload any files to splunk, which is highly annoying.

Thanks for the query, this is working perfectly.

Cheers,

Allan

Re: search a list of servers from a text file

gcusello — Tue, 10 May 2022 12:07:16 GMT

Hi @supersnedz,

good for you, see next time.

Please if my answer solves your need, please accept it for the other people of Community.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated by all the Contributors 😉