Splunk Search

How to build a query which would take input CSV file and search for logs?

shahidkhan545
New Member

I am importing signin logs from azure and I want to built a query which should take input from a csv file (appid)

and search logs and display output for number of success and failures of signins per app

Labels (6)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

@shahidkhan545 You need to explain the problem.  For starters, some sample data (anonymized) would help.  How do 'success' and 'failure' and 'appid' appear in the logs/events?  Are they in fields that are already extracted?  Suppose your event already comes with a field 'status' which can be 'success' or 'failure', and a field 'appid', you can count by something like

source = mysource
| stats count by appid status

 Why do you need a CSV file? (In other words, what is the structure and sample data in your CSV?)

Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...