Splunk Enterprise

Search with lookup

bosseres
Contributor

Hello

I have a lookup, which contains hostnames, how can I make search over indexes (for example index=*) only by hostnames which in lookup? thank you.

Labels (1)
Tags (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @bosseres,

You can try below; I assume your lookup and indexed logs have "hostname" field. Otherwise you may need to rename fields.

index=* [|inputlookup hostname.csv | fields hostname]

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @bosseres,

You can try below; I assume your lookup and indexed logs have "hostname" field. Otherwise you may need to rename fields.

index=* [|inputlookup hostname.csv | fields hostname]

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

bosseres
Contributor

thank you!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index=* [| inputlookup hosts.csv | table host]
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...