Hello
I have a Splunk query that looks like following:
index=something "*abc*" OR "*def*" OR "*hig*"
These substrings do not belong to particular fields. Is there a way to put them in a lookup table?
If they were field values, I would've done something like:
index=something
[| inputlookup My.csv | fields FieldName | format]
If you put the strings in a lookup file using the field name foo then you should be able search for them using this query.
index=something
[| inputlookup My.csv | return 1000 $foo]
If you put the strings in a lookup file using the field name foo then you should be able search for them using this query.
index=something
[| inputlookup My.csv | return 1000 $foo]
Thank you, @richgalloway! I never learned about return command and the use of $field.