Getting Data In

Using CSV file as input to search

insomniacnerd94
Explorer

I am trying to use a list from a CSV file to query results for that list, but I only get a result from the first row.

The data looks like such;
workstation_1
workstation_2
workstation_3

The query looks like such;
index="wineventlog" Source_Workstation=* [inputlookup test.csv | fields "Workstation Name" | rename "Workstation Name" as search] | table Source_Workstation, _time, Logon_Account | dedup Source_Workstation

0 Karma
1 Solution

koshyk
Super Champion

Few mistakes in your search

  1. You need to put a | character before inputlookup

index="wineventlog" Source_Workstation=* [|inputlookup test.csv | fields "Workstation Name" ...

  1. What is the name of the field in WinEventLog where you want WorkStation Name to be compared with? I don't think "Source_Workstation" is the field name. Assuming hostname is the field you want to compare the search would look like..

example

index="wineventlog" [|inputlookup test.csv | fields "Workstation Name" | rename "Workstation Name" as Source_Workstation] | stats count by Source_Workstation, _time, Logon_Account

View solution in original post

koshyk
Super Champion

Few mistakes in your search

  1. You need to put a | character before inputlookup

index="wineventlog" Source_Workstation=* [|inputlookup test.csv | fields "Workstation Name" ...

  1. What is the name of the field in WinEventLog where you want WorkStation Name to be compared with? I don't think "Source_Workstation" is the field name. Assuming hostname is the field you want to compare the search would look like..

example

index="wineventlog" [|inputlookup test.csv | fields "Workstation Name" | rename "Workstation Name" as Source_Workstation] | stats count by Source_Workstation, _time, Logon_Account

insomniacnerd94
Explorer

Thanks for the help, but I actually figured it out. I had the following query;

index="wineventlog" Source_Workstation=* [|inputlookup test.csv | fields "Workstation Name" | rename "Workstation Name" as Source_Workstation] | table Source_Workstation, _time, Logon_Account | dedup Source_Workstation

0 Karma

woodcock
Esteemed Legend

Be sure to click Accept on this answer or post your own and accept that one. Do one or the other to close this question.

koshyk
Super Champion

great. So the above search which I provided above, should also return similar results and would be faster as it directly uses stats count

Please upvote/accept, if it helped you

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...