Splunk Enterprise

Use Lookup value(s) as field values in search query

Path Finder

Hello,
I have a lookup that will only have one column (MY_COL), this column will always have at least one row but could have multiple. I am trying to take the value of the row(s) and use them in a search query like this

index=my_index RuleID=(INSERT LOOKUP VALUES HERE, IF MULTIPLE MAKE IT AN OR STATEMENT)
| table RuleID, etc, etc,

Is there a clean way to do this?
Thanks in advance!

Labels (1)
Tags (3)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Try a subsearch.

index=my_index RuleID=[ |inputlookup mylookup.csv | rename MY_COL as RuleID | fields | RuleID | format ]
| table RuleID, etc, etc,

If you run the subsearch by itself, you'll see how the lookup contents are converted into a series of OR clauses. 

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

SplunkTrust
SplunkTrust

Try a subsearch.

index=my_index RuleID=[ |inputlookup mylookup.csv | rename MY_COL as RuleID | fields | RuleID | format ]
| table RuleID, etc, etc,

If you run the subsearch by itself, you'll see how the lookup contents are converted into a series of OR clauses. 

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

Path Finder

This worked
Although one weird thing I noted was I had to remove the "=" after RuleID to just have it as 
RuleID[ |inputlookup mylookup.csv | rename MY_COL as RuleID | fields RuleID | format]
| table RuleID, etc, etc

Thanks for the assist!

0 Karma

SplunkTrust
SplunkTrust
Actually, the RuleID shouldn't be there at all. The format command will create "RuleID=foo OR RuleID=bar" so it doesn't need to be there before the subsearch.
---
If this reply helps you, an upvote would be appreciated.
0 Karma