Splunk Search

How to search a list of servers from a text file?

supersnedz
Path Finder

Hello, I have been given a list of 40 servers in a text file, all servers are separated by commas for example:

server1, server2, server3 etc

I cant upload the text file to splunk and compare the data that way, so is there a way in the search field i can just list all the servers and search my index? I know i can do OR between each one but im sure there is a quicker way?

 

Thanks,

 

Allan

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @supersnedz,

why cannot you upload a file? can you access the Lookup Editor App?

Anyway, even if you cannot upload a file, are you able to create a lookup?

you could manually add your host list to the lookup.

tha choice you could run a search like this:

index=your index NOT host IN (server1, server2, server3)

Ciao.

Giuseppe

supersnedz
Path Finder

Hi Giuseppe,

 

Thank you for the response. Our splunk is run by a team in another country, and they dont allow local entities to upload any files to splunk, which is highly annoying.

Thanks for the query, this is working perfectly.

Cheers,

Allan

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @supersnedz,

good for you, see next time.

Please if my answer solves your need, please accept it for the other people of Community.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated by all the Contributors 😉

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...