Getting Data In

How do I search multiple source types based on a lookup file?

tusharsaran1
Path Finder

Is there a way to search events from multiple source types when the list of source types is available in a lookup file?

0 Karma
1 Solution

KailA
Contributor

HI !

To complete a bit @elpred0 answer, if you are not used to play with sub search, this is a more complete example of what your search should look like.

index=yourIndex [|inputlookup sourcetype.csv | fields sourcetype]
| your search

That should return all the events in yourIndex with the specified sourcetype in sourcetype.csv

KailA

View solution in original post

KailA
Contributor

HI !

To complete a bit @elpred0 answer, if you are not used to play with sub search, this is a more complete example of what your search should look like.

index=yourIndex [|inputlookup sourcetype.csv | fields sourcetype]
| your search

That should return all the events in yourIndex with the specified sourcetype in sourcetype.csv

KailA

osakachan
Communicator

Hi @tusharsaran1 ,

Try this ...

in the search part of the query add this subsearch

[ |inputlookup lookup
|fields sourcetype
| format]

If the field of the lookup is sourcetype and the values are correctly you will have something like this
( ( sourcetype="a" ) OR ( sourcetype="b" ) OR... etc

Here de docs of format http://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Format

Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...