Hi,
I would like to do a search in Splunk and need several CSV files.
These are monthly scans that all have the same columns and therefore can be easily merged.
Is there a way to do a wildcard search, such as
| inputlookup *_SCAN.csv
?
Otherwise, every month I have to revise all searches when a new report has been uploaded.
You can use a lookup definition to point to the recent .csv file. This would help you not to revise the searches.