topic Re: Input a file into a query, possible? in Splunk Search

Input a file into a query, possible?

gfoligna0 — Thu, 22 Mar 2012 21:09:25 GMT

We're working with really long queries (with a lot of excludes) and we're looking for a solution to short the query and to edit a single file every time we need to add another exclude.

Is it clear to get the point?

Example:

sourcetype=syslog "pattern1" NOT ("blah1" OR "blah2" OR "blah3" OR "blah4" OR "blah5") | stats count by host

Goal:

sourcetype=syslog "pattern1" NOT ( [file somewhere into the splunk searchead] ) | stats count by host

Re: Input a file into a query, possible?

Ayn — Thu, 22 Mar 2012 21:44:05 GMT

Sure. You could create a lookup file somewhere, say for instance $SPLUNK_HOME/etc/system/lookups/excludefilters.csv, and refer to this in a subsearch pretty much like what you're suggesting yourself. The lookup file would have a header first of all defining what field Splunk should read each line's contents into, after that you put one query per line. So for instance with an excludefilters.csv that looks like this:

query
blah1
blah2
...

You could have a query that uses this in the following way:

sourcetype="syslog" "pattern1" NOT [| inputlookup excludefilters.csv | fields query] | stats count by host

Note that the field name "query" is a special field name that makes the subsearch output just the field value instead of fieldname=fieldvalue. So, make sure to use "query" as a field name to have this work for free-text filtering.

Re: Input a file into a query, possible?

gfoligna0 — Thu, 22 Mar 2012 22:58:14 GMT

The solution is perfect.
Should I escape the spaces to look for the complete line instead of every word? Because I found that when I put spaces it starts to search and match for a single word.

Re: Input a file into a query, possible?

gfoligna0 — Thu, 22 Mar 2012 23:00:58 GMT

Yes, spaces, parenthesis... 🙂

Thank you so much!