Splunk Search

How to organize search substrings into LookUp tables?

pm771
Communicator

Hello

I have a Splunk query that looks like following:

 

index=something "*abc*" OR "*def*" OR "*hig*" 

 

These substrings do not belong to particular fields. Is there a way to put them in a lookup table?

If they were field values, I would've done something like: 

 

index=something
   [| inputlookup My.csv |  fields FieldName | format]

 

 

Labels (1)
Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

If you put the strings in a lookup file using the field name foo then you should be able search for them using this query.

index=something
   [| inputlookup My.csv | return 1000 $foo]
---
If this reply helps you, Karma would be appreciated.

View solution in original post

Tags (1)

richgalloway
SplunkTrust
SplunkTrust

If you put the strings in a lookup file using the field name foo then you should be able search for them using this query.

index=something
   [| inputlookup My.csv | return 1000 $foo]
---
If this reply helps you, Karma would be appreciated.
Tags (1)

yuanliu
SplunkTrust
SplunkTrust

Thank you, @richgalloway!  I never learned about return command and the use of $field.

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...