Getting Data In

Splunk search using CSV file data as input

psalibindla9524
New Member

I would like to search

index=main type=router OR type=switch OR type=firewall OR type=sysproxy ..

Instead i wanna do as below
test.csv
devicetype
router
switch
firewall
sysproxy
webproxy


index=main |search [|inputlookup test.csv |feilds devicetype]

It does not return the output. Can you please help how to get the results.

Tags (1)
0 Karma
1 Solution

sundareshr
Legend

In you first search example, the field name appears to be type whereas in the .csv field, field name is devicetype For your subsearch to work, the two needs to be the same. So you could either rename the field in the .csv by editing it, or you could try your search like this

index=main |search [|inputlookup test.csv |rename devicetype AS type | fields type]

View solution in original post

sundareshr
Legend

In you first search example, the field name appears to be type whereas in the .csv field, field name is devicetype For your subsearch to work, the two needs to be the same. So you could either rename the field in the .csv by editing it, or you could try your search like this

index=main |search [|inputlookup test.csv |rename devicetype AS type | fields type]

echalex
Builder

Since sundareshr was first to answer (in a comment), I'm demoting my answer to a comment. The solution is indeed correct, but you can shorten it a bit:

index=main [|inputlookup test.csv |rename devicetype AS type | fields type]

(oh, and I had a typo in my answer... Fixed now.)

0 Karma

tjrhodeback
New Member

There is also a typo "|feilds devicetype]"

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...