Splunk Search

Create a lookup with search queries and have another search search those queries

subtrakt
Contributor

Is there a way i can have a search look at a lookup that has predefined search queries in each row and then run a search across those search queries?

Here's the Lookup:
testLOOKUP
testcolumn
index=test1 test search content1
index=test1 test search content2
index=test1 test search content3

Here's the search:

search [|inputlookup testLOOKUP | table testcolumn] | stats count by host

Would this roll through content1, content2, content3 and then provide results?

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

"Rolling through" as in do one search per row? That'd be the map command:

| inputlookup testLOOKUP | map [search $testcolumn$] | stats count by host

That's not going to be fast, it'd be much faster to run this for your example:

index=text1 (test search content1) OR (test search content2) OR (test search content3) | stats count by host

This could be achieved by running this:

[inputlookup testLOOKUP | rename testcolumn as query | fields query] | stats count by host

Note, this assumes there is no piped commands in the lookup, only filters.

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

"Rolling through" as in do one search per row? That'd be the map command:

| inputlookup testLOOKUP | map [search $testcolumn$] | stats count by host

That's not going to be fast, it'd be much faster to run this for your example:

index=text1 (test search content1) OR (test search content2) OR (test search content3) | stats count by host

This could be achieved by running this:

[inputlookup testLOOKUP | rename testcolumn as query | fields query] | stats count by host

Note, this assumes there is no piped commands in the lookup, only filters.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Not really, there just can't be any pipes involved.

0 Karma

subtrakt
Contributor

in the lookup column, would there be any restriction on how i have the query formatted?

Currently, the queries would look like this in the testcolumn

index="testindex" app="testapp" "search content"

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...