Splunk Search

How to search all indexes with the specified HASH-es in a lookup file?

evallja
Path Finder

Hello,

I have created and imported a lookup file ex. "hashes.csv" and I have pasted there a list of 500+ hashes.

I want to search with index=* to see if I find any of these hashes in _raw field of any type of log.

Thank you in advance.

Labels (1)
Tags (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Assuming the field in your csv is called hash, you could try something like this

index=* [|inputlookup hashes.csv | rename hash as query | fields query | format]

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Assuming the field in your csv is called hash, you could try something like this

index=* [|inputlookup hashes.csv | rename hash as query | fields query | format]

evallja
Path Finder

@ITWhisperer  It worked, thanks a lot!!!

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...