Getting Data In

inputcsv match anywhere

reed_kelly
Contributor

I have a list of usernames in a CSV file. I want to find any events that contain any of these usernames in _raw. I cannot guarantee that there is a field called user or affected_user for every event, so I want to match anywhere in the string. If I try the following, it only matches for the first user:

.. [ inputcsv userlist.csv |return $user ]

but this only matches on the first user in the list.

Does anyone know how I can match any of the users (words) in a list?

This should be the same whether I am using inputcsv or inputlookup.

0 Karma
1 Solution

Ayn
Legend
... [inputcsv userlist.csv | rename user as query | fields query]

"query" (or "search" if you prefer, has same effect) is a special field name that makes Splunk omit the 'field=value' formatting when returning from a subsearch.

View solution in original post

Ayn
Legend
... [inputcsv userlist.csv | rename user as query | fields query]

"query" (or "search" if you prefer, has same effect) is a special field name that makes Splunk omit the 'field=value' formatting when returning from a subsearch.

reed_kelly
Contributor

Running 4.3.1 search head...

0 Karma
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...