New splunk user, trying to get my feet under me. here's the situation;
We have a rather large splunk deployment, and my group often does searches using phone number (TN). Some of our searches involve a lot of numbers, so the search is basically "WTN=0000000000 OR WTN=1111111111 OR..." repeated about a thousand times (not exaggerating, BTW). I've been told that it's easier and faster to use a lookup table instead, but all the reading on lookup tables I've found seem to indicate that adding the .csv makes it more or less a permanent addition to the splunk data, not to mention that the whole process seems kinda convoluted for a simple (and often one-time) search.
Basically, what I'd like to do is be able to say "search index x for the TNs in this .csv, and return these fields" more or less on the fly, without adding a lot of data to splunk that will most likely never be used again. Is there an easy way to do this? Thanks!
