topic Splunk query - lookup utilization in Splunk Search

Splunk query - lookup utilization

KishoreSrini — Fri, 25 Jul 2025 17:22:55 GMT

Hello all,

I am working on an Splunk query which suppose to filter some logs by utilizing data from lookup. Consider a field called host. I have list of host stored on an lookup (let's call the lookup as hostList.csv). Now, I want to retrieve the list of servers from the hostList.csv lookup. And then filter the field host with the retrieved set of list.

Note - I don't want use map command for this.

If is there any other way of pull off this logic. Please help me with example query and explanation.

Thank you!

Re: Splunk query - lookup utilization

ITWhisperer — Fri, 25 Jul 2025 17:55:11 GMT

index=* [| inputlookup hostList.csv | table host ]

Re: Splunk query - lookup utilization

KishoreSrini — Fri, 25 Jul 2025 18:31:19 GMT

Hi @ITWhisperer ,

I have tried this method. The host name on the log is structured like "hostname.abcgroup.com". I want to search like, "hostname*". Since, the hostnames are retrieved from lookup it's working as a static string search. Not filtering the host. I tried like this after get the data from lookup,

| eval host_pattern=host."*"
| table host_pattern

But, this is also not working. I guess the Splunk may consider the wildcard * as string. Since, I am filtering like this. Any suggestion for this...

Re: Splunk query - lookup utilization

ITWhisperer — Mon, 28 Jul 2025 12:31:23 GMT

Try something like this

index=* [| inputlookup hostList.csv | eval string="host=".host."*" | table string | format ]

Re: Splunk query - lookup utilization

KishoreSrini — Mon, 28 Jul 2025 12:22:14 GMT

Hi @ITWhisperer ,

Thank your help.

With your suggestion, I also included a format command to format the output with "OR," which is now working.

index=* [| inputlookup hostList.csv | eval string="host=".host."*" | table string | format]

Once again, Thank you for the help @ITWhisperer .

Re: Splunk query - lookup utilization

ITWhisperer — Mon, 28 Jul 2025 12:32:06 GMT

I have updated my response (I couldn't remember if the default was to format with "OR" or not!)