Getting Data In

How to use a CSV file to search indexes

sajohnson6
Explorer

I have a CSV file already located on our Splunk instance with about 20000 IP's. I would like to use this file to search against our indexed firewall events. I've tried using the join command, it does return some results, but it never finishes. Does anyone know another way to do this?

Thanks in advance.

1 Solution

skoelpin
SplunkTrust
SplunkTrust

I've seen this exact same use case before.. Don't use join, you need to use the lookup command and you need to do the lookup after a transformational command like stats for better performance.

Depending on runtime and size, you may also want to consider summarizing your data and having the lookup run against the summarized data to max out performance

View solution in original post

0 Karma

skoelpin
SplunkTrust
SplunkTrust

I've seen this exact same use case before.. Don't use join, you need to use the lookup command and you need to do the lookup after a transformational command like stats for better performance.

Depending on runtime and size, you may also want to consider summarizing your data and having the lookup run against the summarized data to max out performance

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...