Handling ad hoc groups in a form or search

[cphair]

Hello,

What is the recommended way to handle ad hoc groups? Specifically, if a user has a CSV or text file with a list of hosts to search, what is the best way to get it into Splunk? We have several forms with free-entry text boxes where users can type the hostname they want to search over. They can enter multiple hosts if they use Splunk syntax: (host=foo OR host=bar). However, this requires them to know the syntax, and it's not feasible for large numbers of hosts. We could ask them to run a script over their file to convert it to Splunk syntax and then paste the result into the form. Are there any other options? I want to keep the requisite permissions as minimal as possible.

Note that in some cases we might want to save the groups for future reference within Splunk, and in other cases the group might be completely transient. I'm interested in both cases. Also, if this is easy in the search page but difficult in a form (or vice versa), I'd be interested to know that too.

[ndoshi]

Here's an example of using CSV as input for hosts.

http://blogs.splunk.com/2009/08/28/using-file-contents-as-input-for-search/

You could create a form search or macro that let's user dynamically enter some parts of this search. Also, you could use the collect or ouputlookup commands to save parts of the results of your search to either an index, file, or another CSV.

[cphair]

What if the user doesn't have permission to edit transforms.conf? Say it's a file they generated on the fly.