Splunk Search

Handling ad hoc groups in a form or search

cphair
Builder

Hello,

What is the recommended way to handle ad hoc groups? Specifically, if a user has a CSV or text file with a list of hosts to search, what is the best way to get it into Splunk? We have several forms with free-entry text boxes where users can type the hostname they want to search over. They can enter multiple hosts if they use Splunk syntax: (host=foo OR host=bar). However, this requires them to know the syntax, and it's not feasible for large numbers of hosts. We could ask them to run a script over their file to convert it to Splunk syntax and then paste the result into the form. Are there any other options? I want to keep the requisite permissions as minimal as possible.

Note that in some cases we might want to save the groups for future reference within Splunk, and in other cases the group might be completely transient. I'm interested in both cases. Also, if this is easy in the search page but difficult in a form (or vice versa), I'd be interested to know that too.

Tags (2)

ndoshi
Splunk Employee
Splunk Employee

Here's an example of using CSV as input for hosts.

http://blogs.splunk.com/2009/08/28/using-file-contents-as-input-for-search/

You could create a form search or macro that let's user dynamically enter some parts of this search. Also, you could use the collect or ouputlookup commands to save parts of the results of your search to either an index, file, or another CSV.

0 Karma

cphair
Builder

What if the user doesn't have permission to edit transforms.conf? Say it's a file they generated on the fly.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...