How to search a list of servers from a text file?

[supersnedz]

Hello, I have been given a list of 40 servers in a text file, all servers are separated by commas for example:

server1, server2, server3 etc

I cant upload the text file to splunk and compare the data that way, so is there a way in the search field i can just list all the servers and search my index? I know i can do OR between each one but im sure there is a quicker way?

Thanks,

Allan

[gcusello]

Hi @supersnedz,

why cannot you upload a file? can you access the Lookup Editor App?

Anyway, even if you cannot upload a file, are you able to create a lookup?

you could manually add your host list to the lookup.

tha choice you could run a search like this:

index=your index NOT host IN (server1, server2, server3)

Ciao.

Giuseppe

[supersnedz]

Hi Giuseppe,

Thank you for the response. Our splunk is run by a team in another country, and they dont allow local entities to upload any files to splunk, which is highly annoying.

Thanks for the query, this is working perfectly.

Cheers,

Allan

[gcusello]

Hi @supersnedz,

good for you, see next time.

Please if my answer solves your need, please accept it for the other people of Community.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated by all the Contributors 😉