Getting Data In

How do I search multiple source types based on a lookup file?

tusharsaran1
Path Finder

Is there a way to search events from multiple source types when the list of source types is available in a lookup file?

0 Karma
1 Solution

KailA
Contributor

HI !

To complete a bit @elpred0 answer, if you are not used to play with sub search, this is a more complete example of what your search should look like.

index=yourIndex [|inputlookup sourcetype.csv | fields sourcetype]
| your search

That should return all the events in yourIndex with the specified sourcetype in sourcetype.csv

KailA

View solution in original post

KailA
Contributor

HI !

To complete a bit @elpred0 answer, if you are not used to play with sub search, this is a more complete example of what your search should look like.

index=yourIndex [|inputlookup sourcetype.csv | fields sourcetype]
| your search

That should return all the events in yourIndex with the specified sourcetype in sourcetype.csv

KailA

osakachan
Communicator

Hi @tusharsaran1 ,

Try this ...

in the search part of the query add this subsearch

[ |inputlookup lookup
|fields sourcetype
| format]

If the field of the lookup is sourcetype and the values are correctly you will have something like this
( ( sourcetype="a" ) OR ( sourcetype="b" ) OR... etc

Here de docs of format http://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Format

Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...