Splunk Enterprise

Use Lookup value(s) as field values in search query

wwhite12
Path Finder

Hello,
I have a lookup that will only have one column (MY_COL), this column will always have at least one row but could have multiple. I am trying to take the value of the row(s) and use them in a search query like this

index=my_index RuleID=(INSERT LOOKUP VALUES HERE, IF MULTIPLE MAKE IT AN OR STATEMENT)
| table RuleID, etc, etc,

Is there a clean way to do this?
Thanks in advance!

Labels (1)
Tags (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try a subsearch.

index=my_index RuleID=[ |inputlookup mylookup.csv | rename MY_COL as RuleID | fields | RuleID | format ]
| table RuleID, etc, etc,

If you run the subsearch by itself, you'll see how the lookup contents are converted into a series of OR clauses. 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Try a subsearch.

index=my_index RuleID=[ |inputlookup mylookup.csv | rename MY_COL as RuleID | fields | RuleID | format ]
| table RuleID, etc, etc,

If you run the subsearch by itself, you'll see how the lookup contents are converted into a series of OR clauses. 

---
If this reply helps you, Karma would be appreciated.

wwhite12
Path Finder

This worked
Although one weird thing I noted was I had to remove the "=" after RuleID to just have it as 
RuleID[ |inputlookup mylookup.csv | rename MY_COL as RuleID | fields RuleID | format]
| table RuleID, etc, etc

Thanks for the assist!

0 Karma

richgalloway
SplunkTrust
SplunkTrust
Actually, the RuleID shouldn't be there at all. The format command will create "RuleID=foo OR RuleID=bar" so it doesn't need to be there before the subsearch.
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...