Splunk Search

How to match strings that in a text .file with my logs that indexed?

szone
Engager

hi.

I have a txt file include many strings, and  many logs from my web server that indexed.

I want to find the logs that at least match with one of the string in txt file.

how to search and query for this goal?

thanks.

for example:

txt file:

mosConfig.absolute.path

and logs:

http://localhost/index.php?option=com_sef&Itemid=&mosConfig.absolute.path=[shell.txt?]

and output:

http://localhost/index.php?option=com_sef&Itemid=&mosConfig.absolute.path=[shell.txt?]

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Put the text file into a lookup store e.g. csv and then use inputlookup to include it in the search of your index - start with something like this - you will need to expand on this with your real values

index=xyz [|inputlookup text.csv|format]

 

0 Karma

szone
Engager

thanks, but the lookup table should have at least two column. so I have one column!?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If you are looking something up, then yes you would expect there to be at least two column, but if you are just doing inputlookup you can have just one column

0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcment

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...