https://community.splunk.com/t5/Splunk-Search/How-to-search-all-indexes-with-the-specified-HASH-es-in-a-lookup/m-p/626390#M217718 <P>Hello,</P> <P>I have created and imported a lookup file ex. "hashes.csv" and I have pasted there a list of 500+ hashes.</P> <P>I want to search with index=* to see if I find any of these hashes in _raw field of any type of log.</P> <P>Thank you in advance.</P> Mon, 09 Jan 2023 16:33:19 GMT evallja 2023-01-09T16:33:19Z https://community.splunk.com/t5/Splunk-Search/How-to-search-all-indexes-with-the-specified-HASH-es-in-a-lookup/m-p/626390#M217718 <P>Hello,</P> <P>I have created and imported a lookup file ex. "hashes.csv" and I have pasted there a list of 500+ hashes.</P> <P>I want to search with index=* to see if I find any of these hashes in _raw field of any type of log.</P> <P>Thank you in advance.</P> Mon, 09 Jan 2023 16:33:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-all-indexes-with-the-specified-HASH-es-in-a-lookup/m-p/626390#M217718 evallja 2023-01-09T16:33:19Z https://community.splunk.com/t5/Splunk-Search/How-to-search-all-indexes-with-the-specified-HASH-es-in-a-lookup/m-p/626393#M217720 <P>Assuming the field in your csv is called hash, you could try something like this</P><LI-CODE lang="markup">index=* [|inputlookup hashes.csv | rename hash as query | fields query | format]</LI-CODE> Mon, 09 Jan 2023 11:07:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-all-indexes-with-the-specified-HASH-es-in-a-lookup/m-p/626393#M217720 ITWhisperer 2023-01-09T11:07:21Z https://community.splunk.com/t5/Splunk-Search/How-to-search-all-indexes-with-the-specified-HASH-es-in-a-lookup/m-p/626394#M217721 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp; It worked, thanks a lot!!!</P> Mon, 09 Jan 2023 11:41:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-all-indexes-with-the-specified-HASH-es-in-a-lookup/m-p/626394#M217721 evallja 2023-01-09T11:41:52Z