Splunk Search

How to match strings that in a text .file with my logs that indexed?

szone
Engager

hi.

I have a txt file include many strings, and  many logs from my web server that indexed.

I want to find the logs that at least match with one of the string in txt file.

how to search and query for this goal?

thanks.

for example:

txt file:

mosConfig.absolute.path

and logs:

http://localhost/index.php?option=com_sef&Itemid=&mosConfig.absolute.path=[shell.txt?]

and output:

http://localhost/index.php?option=com_sef&Itemid=&mosConfig.absolute.path=[shell.txt?]

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Put the text file into a lookup store e.g. csv and then use inputlookup to include it in the search of your index - start with something like this - you will need to expand on this with your real values

index=xyz [|inputlookup text.csv|format]

 

0 Karma

szone
Engager

thanks, but the lookup table should have at least two column. so I have one column!?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If you are looking something up, then yes you would expect there to be at least two column, but if you are just doing inputlookup you can have just one column

0 Karma
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...