Splunk Search

How to build a query which would take input CSV file and search for logs?

shahidkhan545
New Member

I am importing signin logs from azure and I want to built a query which should take input from a csv file (appid)

and search logs and display output for number of success and failures of signins per app

Labels (6)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

@shahidkhan545 You need to explain the problem.  For starters, some sample data (anonymized) would help.  How do 'success' and 'failure' and 'appid' appear in the logs/events?  Are they in fields that are already extracted?  Suppose your event already comes with a field 'status' which can be 'success' or 'failure', and a field 'appid', you can count by something like

source = mysource
| stats count by appid status

 Why do you need a CSV file? (In other words, what is the structure and sample data in your CSV?)

Get Updates on the Splunk Community!

Platform Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestIntroducing Splunk Edge Processor, simplified data ...

Enterprise Security Content Updates (ESCU) - New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 3 releases of new content via the Enterprise ...

Thought Leaders are Validating Your Hard Work and Training Rigor

As a Splunk enthusiast and member of the Splunk Community, you are one of thousands who recognize the value of ...