Splunk Search

Are Lookups appropriate here?

marquiselee
Path Finder

I work with a bunch of media companies and on monthly basis licensing for the content they provide changes. So this week I may have rights to display the BRANDS 'NBC' 'HBO' and 'CNN' video content on mobile devices but next week that list may look like 'CBS' NBC' 'AMC' and 'ABC'.

Right now I have many searches that look like this but with nearly 100 brands...

search AND (BRAND="HBO" OR BRAND="CBS" OR BRAND="SHOWTIME") | Table ...

Obviously I'd rather not change each search every time licensing agreements change. I've created a csv listing each of the Brands I have licensing for and added it as a lookup table. that looks like this.

TYPE, VALUE
Brand,HBO
Brand,CBS
Brand,SHOWTIME
Brand,NBC
etc...

Is this a proper use for lookups and how do I implement this in my searches?

Tags (3)
0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

If you place that csv file in the $APP_HOME/lookups (as Brands.csv), you can then combine that with this:

search [ |inputlookup Brands.csv|rename VALUE as Brand|table Brand|format "(" "" "" "" "OR" ")" ]| Table...

View solution in original post

alacercogitatus
SplunkTrust
SplunkTrust

If you place that csv file in the $APP_HOME/lookups (as Brands.csv), you can then combine that with this:

search [ |inputlookup Brands.csv|rename VALUE as Brand|table Brand|format "(" "" "" "" "OR" ")" ]| Table...

marquiselee
Path Finder

thanks much! I got it working eventually... I had to reformat my csv and remove the 'table Brand' from the subsearch. woot!

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

This should return the contents of your CSV: |inputlookup Brands.csv|rename VALUE as Brand|table Brand|format "(" "" "" "" "OR" ")".

marquiselee
Path Finder

hmmm... i must be doing something wrong. I'm not sure it's accessing Brands.csv should a simple search of inputlookup Brands.csv return something?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...