How to reload inputlookup csv file used in a saved realtime search

[bzacher]

Hi,

i am using serveral saved realitime searches for detecting bad requests on the webservers. To exclude some ip addresses, I saved them in a csv file and included it with the command "inputlookup".

For example:

source="/var/log/httpd/vhost.log" uri_query="*bad_keyword*" NOT [ | inputlookup www_ip_whitelist.csv] | top limit=100 clientip | search count>10

As I understood the csv file is only readed once, when the search is saved. What should I do, if I have an updated list in the csv file?

Now I am disableing and reenable the saved searches.

[martin_mueller]

The trouble here is not with inputlookup but rather with subsearches. Those are evaluated first, and the main search is launched after that.

You could define your lookup as a regular automatic lookup and filter based on that. Might degrade search performance a little, but should work with realtime searches. Say your lookup contains a list of IPs, add a field whitelist=1 to each and search like this:

source="/var/log/httpd/vhost.log" uri_query="*bad_keyword*" NOT whitelist=1 | top ...

Didn't test whether this handles reloading a changed lookup file though.

[somesoni2]

Try the solution mentioned here.

http://answers.splunk.com/answers/111220/real-time-search-url-loader-and-inputlookup-issue