Splunk Search

How to create query for multi value attribute?

spisiakmi
Communicator

Hi, can I ask you for helping me with this small problem, please?

If I read the content of the lookUp using any criteria I receive attribute Attr1. This Attr1 is multivalue attribute.

Attr1

7470486
7470487
7470597
7470543
 
I want to create query, where will be index=test ID=7470486 OR 7470487 OR 7470597 OR 7470543
 
 
Labels (2)
0 Karma
1 Solution

somesoni2
Revered Legend

Try something like this

index=test [| inputlookup yourlookup.csv | where...your criteria.. | table Attr1 | rename Attr1 as ID]

View solution in original post

0 Karma

somesoni2
Revered Legend

Try something like this

index=test [| inputlookup yourlookup.csv | where...your criteria.. | table Attr1 | rename Attr1 as ID]
0 Karma

spisiakmi
Communicator

Hi somesoni2,

this is amazing simple. Absolutely perfect. Thank you very much. Works fine.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...