Getting Data In

Using a .csv as part of a search

New Member

New splunk user, trying to get my feet under me. here's the situation;

We have a rather large splunk deployment, and my group often does searches using phone number (TN). Some of our searches involve a lot of numbers, so the search is basically "WTN=0000000000 OR WTN=1111111111 OR..." repeated about a thousand times (not exaggerating, BTW). I've been told that it's easier and faster to use a lookup table instead, but all the reading on lookup tables I've found seem to indicate that adding the .csv makes it more or less a permanent addition to the splunk data, not to mention that the whole process seems kinda convoluted for a simple (and often one-time) search.

Basically, what I'd like to do is be able to say "search index x for the TNs in this .csv, and return these fields" more or less on the fly, without adding a lot of data to splunk that will most likely never be used again. Is there an easy way to do this? Thanks!

0 Karma

Esteemed Legend

Let's assume that you have a lookup file called WTN.csv which has a header line that says only WTN. You can skip all WTNs in the file like this:

Your Search Here NOT [|inputscsv WTN.csv]
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!