Splunk Search

Handling ad hoc groups in a form or search

cphair
Builder

Hello,

What is the recommended way to handle ad hoc groups? Specifically, if a user has a CSV or text file with a list of hosts to search, what is the best way to get it into Splunk? We have several forms with free-entry text boxes where users can type the hostname they want to search over. They can enter multiple hosts if they use Splunk syntax: (host=foo OR host=bar). However, this requires them to know the syntax, and it's not feasible for large numbers of hosts. We could ask them to run a script over their file to convert it to Splunk syntax and then paste the result into the form. Are there any other options? I want to keep the requisite permissions as minimal as possible.

Note that in some cases we might want to save the groups for future reference within Splunk, and in other cases the group might be completely transient. I'm interested in both cases. Also, if this is easy in the search page but difficult in a form (or vice versa), I'd be interested to know that too.

Tags (2)

ndoshi
Splunk Employee
Splunk Employee

Here's an example of using CSV as input for hosts.

http://blogs.splunk.com/2009/08/28/using-file-contents-as-input-for-search/

You could create a form search or macro that let's user dynamically enter some parts of this search. Also, you could use the collect or ouputlookup commands to save parts of the results of your search to either an index, file, or another CSV.

0 Karma

cphair
Builder

What if the user doesn't have permission to edit transforms.conf? Say it's a file they generated on the fly.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...