Splunk Enterprise Security

using lookup values as input to variable

Path Finder

Splunk search query :

index="something" | search hostname=variable

  • using lookup file, map the variable value

Please help.

Thanks in advance

0 Karma

Esteemed Legend

With a subsearch, like this:

index="something" AND [|inputlookup YourLookupNameHere.csv | table hostname | format]


Are you asking for how to reference a csv based on a variable value? There is a lookup command https://docs.splunk.com/Documentation/Splunk/7.3.2/SearchReference/Lookup#Basic_example that you can use - in this case the syntax would look something like:

base search...
| lookup csvName.csv variable OUTPUT fieldsToOutput

In this case variable is the joining field between the csv and the base search, and you can OUTPUT whatever fields you want from that row (comma separated list).

Does this answer your question?

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...