topic Use Lookup To Filter Events in Splunk Search

Use Lookup To Filter Events

HeinzWaescher — Mon, 11 Nov 2013 10:53:10 GMT

Hi,

in my searches I want to filter my events when the field "Version" has specific values. The list of values I want to include in the searches will increase over time and would it be nice to have an ease way to handle this, instead of adjusting all searches everytime.

Is it possible to use a lookuptable in the a search to achieve this? So that I will just have to adjust the lookuptable to define the filter for my needed "Versions".

Thanks in advance

Heinz

Re: Use Lookup To Filter Events

Damien_Dallimor — Mon, 11 Nov 2013 11:19:17 GMT

You could use the inputlookup command to do this.

So you might have a lookup file called versions.csv

Version
1.0
2.0
3.0

And then you can use a search like :

<search terms> [ | inputlookup <your lookup> ]

index=foo sourcetype=goo [ | inputlookup versions | fields Version ]

Re: Use Lookup To Filter Events

HeinzWaescher — Mon, 11 Nov 2013 11:50:19 GMT

Hi,

thanks, that's a way I was looking for 🙂
Will this kind of command filter exact matches of the fieldvalue? Or will the output include a Version 1.0.1 as well, when your example above is used?

Re: Use Lookup To Filter Events

Damien_Dallimor — Mon, 11 Nov 2013 11:52:28 GMT

Exact matches. So your lookup file will need all the versions explictly entered.

Re: Use Lookup To Filter Events

HeinzWaescher — Mon, 11 Nov 2013 11:53:30 GMT

Ok, that's nice. Thanks a lot for your help!

Re: Use Lookup To Filter Events

bagarwal — Thu, 05 Jan 2017 10:51:27 GMT

Hi @Damien Dallimore [Splunk],

I tried for similar outcome to search my query ; however no result is found.
Note: In my .csv file there is only one column and it looks like below:
Application
abc*
xyz*
aaa* n so on.

Query is
index="index_name" [ | inputlookup "filename" | fields Application ] | table field1, field2

Anything I am missing. Kindly help.

Thanks & Regards,
Binay Agarwal